Cluster 08: VEN-BSD

["Steven M. Christey" <coley@linus.mitre.org>]

This cluster has 13 vulnerabilities.


------------------------------------------
Candidate: CAN-1999-0052
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: FreeBSD:FreeBSD-SA-98:08

IP fragmentation denial of service in FreeBSD

------------------------------------------
Candidate: CAN-1999-0053
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: FreeBSD:FreeBSD-SA-98:07

TCP RST denial of sevice in FreeBSD

------------------------------------------
Candidate: CAN-1999-0367
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-002

NetBSD netstat command allows local users to access kernel memory.

------------------------------------------
Candidate: CAN-1999-0396
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-001
Reference: OPENBSD:Feb17,1999

A race condition between the select() and accept() calls in NetBSD TCP
servers allows remote attackers to cause a denial of service.

------------------------------------------
Candidate: CAN-1999-0420
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-006

umapfs allows local users to gain root privileges by changing their
uid through a malicious mount_umap program.

------------------------------------------
Candidate: CAN-1999-0422
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-007

In some cases, NetBSD 1.3.3 mount allows local users to execute
programs in some file systems that have the "noexec" flag set.

------------------------------------------
Candidate: CAN-1999-0446
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-008
Reference: XF:netbsd-vfslocking-panic

Local users can perform a denial of service in NetBSD 1.3.3 and
earlier versions by creating an unusual symbolic link with the ln
command, triggering a bug in VFS.

------------------------------------------
Candidate: CAN-1999-0466
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: NETBSD:1999-009

The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier
allows a local user to read or write arbitrary files on the disk
associated with that device.

------------------------------------------
Candidate: CAN-1999-0481
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: OPENBSD:Mar22,1999

Denial of service in "poll" in OpenBSD.

------------------------------------------
Candidate: CAN-1999-0482
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: OPENBSD:Mar21,1999

OpenBSD kernel crash through TSS handling, as caused by the crashme
program.

------------------------------------------
Candidate: CAN-1999-0483
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: OPENBSD:Feb25,1999

OpenBSD crash using nlink value in FFS and EXT2FS filesystems.

------------------------------------------
Candidate: CAN-1999-0484
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: OPENBSD:Feb23,1999

Buffer overflow in OpenBSD ping.

------------------------------------------
Candidate: CAN-1999-0485
Proposer: 001
Assigned: 19990617
Announced: 19990617
Category: SF
Reference: OPENBSD:Feb19,1999

Remote attackers can cause a denial of service through ipintr() in ipq
in OpenBSD.