NetBSD TIOCSCTTY ioctl structure counter buffer overflow
| netbsd-tiocsctty-ioctl-bo (10115) |  Medium Risk |
Description:
NetBSD could allow a local attacker to cause a kernel panic, caused by a buffer overflow in the structure counter. By making multiple TIOCSCTTY ioctl calls when setting a session controlling terminal, a local attacker could cause the structure counter buffer to overflow and cause memory to be freed prematurely. This could cause a kernel panic when another process accesses the session structure, which could cause a denial of service.
Platforms Affected:
- NetBSD, NetBSD 1.4
- NetBSD, NetBSD 1.4.1
- NetBSD, NetBSD 1.4.2
- NetBSD, NetBSD 1.4.3
- NetBSD, NetBSD 1.5
- NetBSD, NetBSD 1.5.1
- NetBSD, NetBSD 1.5.2
- NetBSD, NetBSD 1.5.3
- NetBSD, NetBSD 1.6 beta
Remedy:
For NetBSD-current:
Upgrade to the latest version of NetBSD-current (dated 2002-07-22 or later), as listed in NetBSD Security Advisory 2002-007. See References.
For NetBSD 1.6 beta and 1.6 release candidates:
Upgrade to the latest version of the NetBSD 1.6 release (dated 2002-07-22 or later), as listed in NetBSD Security Advisory 2002-007. See References.
For NetBSD 1.5, 1.5.1, 1.5.2, and 1.5.3:
Upgrade to the latest version of the NetBSD 1.5 branch (dated 2002-09-05 or later), as listed in NetBSD Security Advisory 2002-007. See References.
—OR—
Apply the appropriate patch for your system, as listed in NetBSD Security Advisory 2002-007. See References.
Consequences:
Denial of Service
References:
- Full-Disclosure Mailing List, Mon Sep 16 2002 - 20:58:05 CDT, Repeated TIOCSCTTY ioctl can corrupt session hold counts at http://archives.neohapsis.com/archives/fulldisclosure/2002-q3/1001.html. (From Full-Disclosure Mailing List archive)
- BID-5722: NetBSD Repeated TIOSCTTY IOCTL Buffer Overflow Vulnerability
- CVE-2002-1490: NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service (kernel panic) via a series of calls to the TIOCSCTTY ioctl, which causes an integer overflow in a structure counter and sets the counter to zero, which frees memory that is still in use by other processes.
- OSVDB ID: 7566: NetBSD TIOCSCTTY ioctl Overflow DoS
Reported:
Sep 17, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net