NetBSD kernel sendmsg(2) denial of service
| bsd-kernel-sendmsg-dos (6908) |  Medium Risk |
Description:
The NetBSD kernel in NetBSD is vulnerable to a denial of service attack, caused by insufficient length checking of the `msg_controllen¿ in the sendmsg(2) function. A local attacker can set the `msg_controllen¿ length to a very large value, to cause a page fault trap or kernel panic.
Consequences:
Denial of Service
Remedy:
For NetBSD 1.3, 1.3.1, 1.3.2, and 1.3.3:
Apply the 1.3-1.5 sendmsg patch, as listed in NetBSD Security Advisory, August 8, 2000. See References.
For NetBSD 1.4, 1.4.1, 1.4.2, and 1.4.3:
Upgrade to the latest version of NetBSD (1.4 dated 2001-07-19 or later), as listed in NetBSD Security Advisory, August 8, 2000. See References.
— OR —
Apply the 1.3-1.5 patch, as listed in NetBSD Security Advisory, August 8, 2000. See References.
For NetBSD 1.5:
Upgrade to the latest version of NetBSD (1.5 dated 2001-07-02 or later), as listed in NetBSD Security Advisory, August 8, 2000. See References.
— OR —
Apply the 1.3-1.5 patch, as listed in NetBSD Security Advisory, August 8, 2000. See References.
References:
- NetBSD Security Advisory 2000-011: Insufficient msg_controllen checking for sendmsg(2).
- BID-3088: NetBSD sendmsg Denial of Service Vulnerability
- CVE-2001-0993: sendmsg function in NetBSD 1.3 through 1.5 allows local users to cause a denial of service (kernel trap or panic) via a msghdr structure with a large msg_controllen length.
- OSVDB ID: 1910: NetBSD sendmsg msg_controllen DoS
Platforms Affected:
- NetBSD NetBSD 1.3
- NetBSD NetBSD 1.3.1
- NetBSD NetBSD 1.3.2
- NetBSD NetBSD 1.3.3
- NetBSD NetBSD 1.4
- NetBSD NetBSD 1.4.1
- NetBSD NetBSD 1.4.2
- NetBSD NetBSD 1.4.3
- NetBSD NetBSD 1.5
Reported:
Jul 20, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net