OpenBSD PF Remote Denial Of Service Vulnerability

Bugtraq ID:	34482
Class:	Design Error
CVE:	CVE-2009-0687
Remote:	Yes
Local:	No
Published:	Apr 11 2009 12:00AM
Updated:	Aug 21 2009 03:54PM
Credit:	OpenBSD
Vulnerable:	OpenBSD OpenBSD 4.5 OpenBSD OpenBSD 4.4 OpenBSD OpenBSD 4.3 NetBSD NetBSD 5.0 RC3 MirOS MirOS #10 MidnightBSD MidnightBSD 0.3
Not Vulnerable:	NetBSD NetBSD 5.0

OpenBSD PF Remote Denial Of Service Vulnerability

OpenBSD's PF is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause a kernel panic on affected computers, denying further service to legitimate users.

The following are vulnerable:

OpenBSD 4.3, 4.4, and 4.5
NetBSD 5.x prior April 13th, 2009
MirOS #10
MidnightBSD 0.3-current

OpenBSD PF Remote Denial Of Service Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/34482.py

OpenBSD PF Remote Denial Of Service Vulnerability

Solution:
The vendor has released updates. Please contact the vendor for details.


OpenBSD OpenBSD 4.3

• OpenBSD 002_pf.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.5/common/002_pf.patch

OpenBSD OpenBSD 4.4

• OpenBSD 002_pf.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.5/common/002_pf.patch

OpenBSD OpenBSD 4.5

• OpenBSD 002_pf.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.5/common/002_pf.patch

OpenBSD PF Remote Denial Of Service Vulnerability

References:

• 002: RELIABILITY FIX: April 11, 2009 (OpenBSD)
  
• Multiple vendor PF NULL pointer dereference remote DoS (Rembrandt)
  
• OpenBSD Homepage (OpenBSD)
  
• OpenBSD Security Information (OpenBSD)
  
• multiple vendor - PF NULL pointer dereference (rembrandt )
  
• OpenBSD 4.3 up to OpenBSD-current: PF null pointer dereference - remote DoS (ker (rembrandt )