NetBSD Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability

Bugtraq ID:	48528
Class:	Boundary Condition Error
CVE:	CVE-2011-1656
Remote:	Yes
Local:	No
Published:	Jul 01 2011 12:00AM
Updated:	Jul 01 2011 12:00AM
Credit:	Maksymilian Arciemowicz
Vulnerable:	NetBSD NetBSD 5.1
Not Vulnerable:

NetBSD Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability

NetBSD is prone to a stack-based buffer-overflow vulnerability affecting multiple functions in the 'libc/net' library.

Successful exploits may allow an attacker to execute arbitrary code in the context of the application using the affected library. Failed exploit attempts will result in a denial-of-service condition.

NetBSD Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/48528.c

NetBSD Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

NetBSD Multiple 'libc/net' Functions Stack Buffer Overflow Vulnerability

References:

• NetBSD Homepage (NetBSD)
  
• CVS log for src/lib/libc/net/getservbyname_r.c (The NetBSD Foundation)
  
• CVS log for src/lib/libc/net/getservbyport_r.c (The NetBSD Foundation)
  
• NetBSD 5.1 libc/net multiple functions stack buffer overflow (SecurityReason)