Exploit the possiblities
Showing 1 - 25 of 1,187 RSS Feed

Operating System: FreeBSD

FreeBSD Security Advisory - FreeBSD-SA-17:12.openssl
Posted Dec 12, 2017
Site security.freebsd.org

FreeBSD Security Advisory - Invoking SSL_read()/SSL_write() while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. Various other issues were addressed.

tags | advisory
systems | freebsd, bsd
advisories | CVE-2017-3737, CVE-2017-3738
MD5 | 3475ce3c92c45de6eb4652ec337d3e53
FreeBSD Security Advisory - FreeBSD-SA-17:08.ptrace
Posted Nov 17, 2017
Authored by John Baldwin | Site security.freebsd.org

FreeBSD Security Advisory - Not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger. Some bytes from the kernel stack of the thread using ptrace(PT_LWPINFO) call can be observed in userspace.

tags | advisory, kernel
systems | freebsd
advisories | CVE-2017-1086
MD5 | 4185c6c38d161594900777f2d539e495
FreeBSD Security Advisory - FreeBSD-SA-17:10.kldstat
Posted Nov 16, 2017
Authored by TJ Corley | Site security.freebsd.org

FreeBSD Security Advisory - The kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible. Some bytes from the kernel stack can be observed in userspace.

tags | advisory, kernel
systems | freebsd
advisories | CVE-2017-1088
MD5 | 85acdc3509c9475e03880d4caef12c90
FreeBSD Security Advisory - FreeBSD-SA-17:09.shm
Posted Nov 16, 2017
Authored by WhiteWinterWolf | Site security.freebsd.org

FreeBSD Security Advisory - Named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. A malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid. This issue could lead to a Denial of Service or local privilege escalation.

tags | advisory, denial of service, local
systems | freebsd, osx
advisories | CVE-2017-1087
MD5 | b2681ba643cf5c4f71bab8fbcbe6dd35
FreeBSD Security Advisory - FreeBSD-SA-17:07.wpa
Posted Oct 19, 2017
Authored by Mathy Vanhoef | Site security.freebsd.org

FreeBSD Security Advisory - A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used.

tags | advisory, vulnerability
systems | freebsd, bsd
advisories | CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088
MD5 | dd1ceecd8830ca90a5666d6a9425ade7
FreeBSD 10.3 Jail SHM Issue
Posted Aug 16, 2017
Authored by WhiteWinterWolf

FreeBSD jail incompletely protects the access to the IPC primitives. The 'allow.sysvipc' setting only affects IPC queues, leaving other IPC objects unprotected, making them reachable system-wide independently of the system configuration. Versions 7.0 through 10.3 are affected. Proof of concept included.

tags | exploit, proof of concept
systems | freebsd, bsd
MD5 | e7bb338f4932b0dcb05045dbf728194c
FreeBSD setrlimit Stack Clash Proof Of Concept
Posted Jun 29, 2017
Site qualys.com

FreeBSD setrlimit stack clash proof of concept exploit.

tags | exploit, proof of concept
systems | freebsd, bsd
advisories | CVE-2017-1085
MD5 | 6eba2939821ab24edba2b623a0df6a80
FreeBSD FGPE Stack Clash Proof Of Concept
Posted Jun 29, 2017
Site qualys.com

FreeBSD FGPE stack clash proof of concept exploit.

tags | exploit, proof of concept
systems | freebsd, bsd
advisories | CVE-2017-1084
MD5 | a5bf5e251c7b1182eb8d9d86a7cba5ec
FreeBSD FGPU Stack Clash Proof Of Concept
Posted Jun 29, 2017
Site qualys.com

FreeBSD FGPU stack clash proof of concept exploit.

tags | exploit, proof of concept
systems | freebsd, bsd
advisories | CVE-2017-1084
MD5 | 4df3d0a41e548c26a0c180b85a467afb
FreeBSD Security Advisory - FreeBSD-SA-17:04.ipfilter
Posted Apr 27, 2017
Authored by Cy Schubert | Site security.freebsd.org

FreeBSD Security Advisory - ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed). Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.

tags | advisory, denial of service, udp, tcp, memory leak
systems | freebsd
advisories | CVE-2017-1081
MD5 | 52202a1372fafbdf07a4259245a5e409
FreeBSD Security Advisory - FreeBSD-SA-17:03.ntp
Posted Apr 12, 2017
Authored by Network Time Foundation | Site security.freebsd.org

FreeBSD Security Advisory - A vulnerability was discovered in the NTP server's parsing of configuration directives. A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. A vulnerability was discovered in the NTP server's parsing of configuration directives. A vulnerability was found in NTP, affecting the origin timestamp check function. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. A malicious device could send crafted messages, causing ntpd to crash. An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service.

tags | advisory, remote, denial of service, spoof
systems | freebsd, bsd
advisories | CVE-2016-9042, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464
MD5 | c169a99d362c1ddf8d4e9d7e28573bae
rldns 1.1
Posted Mar 23, 2017
Authored by Ringlayer | Site ringlayer.net

rldns is an open source lightweight DNS server for linux, netbsd, freebsd, and openbsd. Runs on x86 and x86_64 architectures.

Changes: Various updates.
tags | tool, x86
systems | linux, netbsd, unix, freebsd, bsd, openbsd
MD5 | fa1b4c747d0ea7b13c02993fbb0336e7
rldns 1.0
Posted Mar 13, 2017
Authored by Ringlayer | Site ringlayer.net

rldns is an open source lightweight DNS server for linux, netbsd, freebsd, and openbsd. Runs on x86 and x86_64 architectures.

tags | tool, x86
systems | linux, netbsd, unix, freebsd, bsd, openbsd
MD5 | 0ff54b024b64c4bf409da6fc84703fec
FreeBSD Security Advisory - FreeBSD-SA-17:02.openssl
Posted Feb 23, 2017
Site security.freebsd.org

FreeBSD Security Advisory - If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. Various other issues have also been identified.

tags | advisory
systems | freebsd, bsd
advisories | CVE-2016-7055, CVE-2017-3731, CVE-2017-3732
MD5 | 61e028674e75cf79a6ef2b0daf4f97e0
FreeBSD Security Advisory - FreeBSD-SA-17:01.openssh
Posted Jan 11, 2017
Site security.freebsd.org

FreeBSD Security Advisory - The ssh-agent(1) agent supports loading a PKCS#11 module from outside a trusted whitelist. An attacker can request loading of a PKCS#11 module across forwarded agent-socket. When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. A remote attacker who have control of a forwarded agent-socket on a remote system and have the ability to write files on the system running ssh-agent(1) agent can run arbitrary code under the same user credential. Because the attacker must already have some control on both systems, it is relatively hard to exploit this vulnerability in a practical attack. When privilege separation is disabled (on FreeBSD, privilege separation is enabled by default and has to be explicitly disabled), an authenticated attacker can potentially gain root privileges on systems running OpenSSH server.

tags | advisory, remote, arbitrary, root
systems | unix, freebsd, bsd
advisories | CVE-2016-10009, CVE-2016-10010
MD5 | 2022ff5492e80b6bf9eb7f85b3d2016f
FreeBSD Security Advisory - FreeBSD-SA-16.39.ntp
Posted Dec 21, 2016
Authored by Network Time Foundation | Site security.freebsd.org

FreeBSD Security Advisory - Multiple vulnerabilities have been discovered in the NTP suite.

tags | advisory, vulnerability
systems | freebsd, bsd
advisories | CVE-2016-7426, CVE-2016-7427, CVE-2016-7428, CVE-2016-7431
MD5 | 758701c6c332f8937e8764717b895f4a
FreeBSD Security Advisory - FreeBSD-SA-16:15.sysarch
Posted Oct 25, 2016
Authored by ahaha | Site security.freebsd.org

FreeBSD Security Advisory - A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

tags | advisory, denial of service, kernel, local
systems | freebsd
advisories | CVE-2016-1885
MD5 | 2928e81b104e6f66784c2fc8aa82ca7e
FreeBSD Security Advisory - FreeBSD-SA-16:25.bspatch
Posted Jul 25, 2016
Site security.freebsd.org

FreeBSD Security Advisory - The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was first discovered by The Chromium Project and reported independently by Lu Tung-Pin to the FreeBSD project. An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root.

tags | advisory, arbitrary, root
systems | freebsd
advisories | CVE-2014-9862
MD5 | 82e698f904115c3510c38a29f992e781
FreeBSD Security Advisory - FreeBSD-SA-16:24.ntp
Posted Jun 6, 2016
Site security.freebsd.org

FreeBSD Security Advisory - Multiple vulnerabilities have been discovered in the NTP suite.

tags | advisory, vulnerability
systems | freebsd, bsd
advisories | CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4957
MD5 | fce94472a944196f57b09c666a948569
FreeBSD Security Advisory - FreeBSD-SA-16:20.linux
Posted Jun 1, 2016
Authored by CTurt | Site security.freebsd.org

FreeBSD Security Advisory - The implementation of the TIOCGSERIAL ioctl(2) does not clear the output struct before copying it out to userland. The implementation of the Linux sysinfo() system call does not clear the output struct before copying it out to userland. An unprivileged user can read a portion of uninitialised kernel stack data, which may contain sensitive information, such as the stack guard, portions of the file cache or terminal buffers, which an attacker might leverage to obtain elevated privileges.

tags | advisory, kernel
systems | linux, freebsd
MD5 | 1e15711ef418910a989c906474f5221c
FreeBSD Security Advisory - FreeBSD-SA-16:22.libarchive
Posted Jun 1, 2016
Authored by Alexander Cherepanov | Site security.freebsd.org

FreeBSD Security Advisory - The cpio(1) tool from the libarchive(3) bundle is vulnerable to a directory traversal problem via absolute paths in an archive file. A malicious archive file being unpacked can overwrite an arbitrary file on a filesystem, if the owner of the cpio process has write access to it.

tags | advisory, arbitrary
systems | freebsd
advisories | CVE-2015-2304
MD5 | 274629714de89c0dd89194957e9ee690
FreeBSD Security Advisory - FreeBSD-SA-16:23.libarchive
Posted Jun 1, 2016
Site security.freebsd.org

FreeBSD Security Advisory - An integer signedness error in the archive_write_zip_data() function in archive_write_set_format_zip.c in libarchive(2) could lead to a buffer overflow on 64-bit machines. An attacker who can provide input of their choice for creating a ZIP archive can cause a buffer overflow in libarchive(2) that results in a core dump or possibly execution of arbitrary code provided by the attacker.

tags | advisory, overflow, arbitrary
systems | freebsd
advisories | CVE-2013-0211
MD5 | 4e380ba863ed7b8823111e3484f3780e
FreeBSD Security Advisory - FreeBSD-SA-16:21.43bsd
Posted Jun 1, 2016
Authored by CTurt | Site security.freebsd.org

FreeBSD Security Advisory - The implementation of historic stat(2) system call does not clear the output struct before copying it out to userland. An unprivileged user can read a portion of uninitialised kernel stack data, which may contain sensitive information, such as the stack guard, portions of the file cache or terminal buffers, which an attacker might leverage to obtain elevated privileges.

tags | advisory, kernel
systems | freebsd
MD5 | 050fa392be53d3265e4e182e8ba729df
FreeBSD Security Advisory - FreeBSD-SA-16:19.sendmsg
Posted May 18, 2016
Authored by CTurt and the HardenedBSD team | Site security.freebsd.org

FreeBSD Security Advisory - Incorrect argument handling in the socket code allows malicious local user to overwrite large portion of the kernel memory. Malicious local user may crash kernel or execute arbitrary code in the kernel, potentially gaining superuser privileges.

tags | advisory, arbitrary, kernel, local
systems | freebsd
advisories | CVE-2016-1887
MD5 | 4d6effae01c6a211307b96d8442db080
FreeBSD Security Advisory - FreeBSD-SA-16:18.atkbd
Posted May 18, 2016
Authored by CTurt and the HardenedBSD team | Site security.freebsd.org

FreeBSD Security Advisory - Incorrect signedness comparison in the ioctl(2) handler allows a malicious local user to overwrite a portion of the kernel memory. A local user may crash the kernel, read a portion of kernel memory and execute arbitrary code in kernel context. The result of executing an arbitrary kernel code is privilege escalation.

tags | advisory, arbitrary, kernel, local
systems | freebsd
advisories | CVE-2016-1886
MD5 | db2cefadc213a78dbd47951a813ce706
Page 1 of 48
Back12345Next

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    44 Files
  • 13
    Dec 13th
    25 Files
  • 14
    Dec 14th
    15 Files
  • 15
    Dec 15th
    28 Files
  • 16
    Dec 16th
    3 Files
  • 17
    Dec 17th
    13 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close