NetBSD sendmsg Denial of Service Vulnerability
BID:3088
Info
NetBSD sendmsg Denial of Service Vulnerability
| Bugtraq ID: | 3088 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 24 2001 12:00AM |
| Updated: | Jul 24 2001 12:00AM |
| Credit: | Published in a NetBSD Security Advisory on July 24, 2001. |
| Vulnerable: |
NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD current pre20010701 |
| Not Vulnerable: |
NetBSD NetBSD 1.5.1 |
Discussion
NetBSD sendmsg Denial of Service Vulnerability
A potential denial of service vulnerability exists in the NetBSD kernel.
The problem is the result of an input validation error in the sendmsg(2) function and is due to insufficient length checking on the 'msg_controllen' member of the 'msghdr' structure.
Because the kernel fails to check the length given with the msg_controllen member, it is possible to cause a page fault trap or 'out of space in kmem_map' kernel panic if the value is sized to a large enough value.
A potential denial of service vulnerability exists in the NetBSD kernel.
The problem is the result of an input validation error in the sendmsg(2) function and is due to insufficient length checking on the 'msg_controllen' member of the 'msghdr' structure.
Because the kernel fails to check the length given with the msg_controllen member, it is possible to cause a page fault trap or 'out of space in kmem_map' kernel panic if the value is sized to a large enough value.
Solution / Fix
NetBSD sendmsg Denial of Service Vulnerability
Solution:
Vendor-supplied updates that rectify this issue are available:
NetBSD NetBSD current pre20010701
NetBSD NetBSD 1.3
NetBSD NetBSD 1.3.1
NetBSD NetBSD 1.3.2
NetBSD NetBSD 1.3.3
NetBSD NetBSD 1.4
NetBSD NetBSD 1.4.1
NetBSD NetBSD 1.4.2
NetBSD NetBSD 1.4.3
NetBSD NetBSD 1.5
Solution:
Vendor-supplied updates that rectify this issue are available:
NetBSD NetBSD current pre20010701
-
NetBSD SA2001-011-sendmsg-current.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-cu rrent.patch
NetBSD NetBSD 1.3
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.3.1
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.3.2
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.3.3
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.4
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.4.1
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.4.2
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.4.3
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
NetBSD NetBSD 1.5
-
NetBSD SA2001-011-sendmsg-1.3-1.5.patch
ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-011-sendmsg-1. 3-1.5.patch
References
NetBSD sendmsg Denial of Service Vulnerability
References:
References: