FreeBSD Crypto Local Denial of Service Vulnerability

Bugtraq ID:	20713
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Oct 24 2006 12:00AM
Updated:	Oct 25 2006 05:18PM
Credit:	Evgeny Legerov is credited with discovering this issue.
Vulnerable:	OpenBSD OpenBSD 3.9 FreeBSD FreeBSD 6.1 -STABLE FreeBSD FreeBSD 6.1 -RELEASE-p10 FreeBSD FreeBSD 6.1 -RELEASE
Not Vulnerable:

FreeBSD Crypto Local Denial of Service Vulnerability

FreeBSD is prone to a local denial-of-service vulnerability because it fails to handle exceptional conditions.

An attacker may leverage this issue to crash the affected computer, denying service to legitimate users. Under certain conditions, successful exploits may also corrupt the filesystem.

FreeBSD version 6.1 is vulnerable to this issue; other versions may also be affected. The reporter of this issue states that OpenBSD may also be affected.

FreeBSD Crypto Local Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/20713.c

FreeBSD Crypto Local Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

FreeBSD Crypto Local Denial of Service Vulnerability

References:

• FreeBSD Homepage (FreeBSD)
  
• Here is a lame proof of concept code for FreeBSD kernel /dev/crypto vulnerabilit (Evgeny Legerov)