NetBSD ISO(4) Buffer Overflow Vulnerability

Bugtraq ID:	23193
Class:	Boundary Condition Error
CVE:	CVE-2007-1677
Remote:	No
Local:	Yes
Published:	Mar 29 2007 12:00AM
Updated:	Mar 29 2007 05:43PM
Credit:	Christer Oberg of BitSec is credited with the discovery of this vulnerability.
Vulnerable:	NetBSD NetBSD 3.0.2 NetBSD NetBSD 3.0.1 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD 4.0 BETA2 NetBSD NetBSD 4.0 NetBSD NetBSD 4,0_Beta NetBSD NetBSD 3.1_RC3 NetBSD NetBSD 3.1 NetBSD NetBSD 3.1 NetBSD NetBSD 3,1_RC1 NetBSD NetBSD 2.1.1 NetBSD NetBSD 2.0.4 Navision Financials Server 3.0
Not Vulnerable:

NetBSD ISO(4) Buffer Overflow Vulnerability

NetBSD 'ISO' is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

A local attacker may be able to exploit this issue to elevate privileges to superuser or cause denial-of-service conditions.

NetBSD ISO(4) Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

NetBSD ISO(4) Buffer Overflow Vulnerability

Solution:
The vendor has released a patch to address this issue in affected kernels. Please contact the vendor for details on obtaining and applying the appropriate updates.

NetBSD ISO(4) Buffer Overflow Vulnerability

References:

• NetBSD Homepage (NetBSD)
  
• NetBSD Security Advisory 2007-004 (NetBSD)