Exploit the possiblities
Showing 26 - 50 of 1,188 RSS Feed

Operating System: FreeBSD

FreeBSD Security Advisory - FreeBSD-SA-16:18.atkbd
Posted May 18, 2016
Authored by CTurt and the HardenedBSD team | Site security.freebsd.org

FreeBSD Security Advisory - Incorrect signedness comparison in the ioctl(2) handler allows a malicious local user to overwrite a portion of the kernel memory. A local user may crash the kernel, read a portion of kernel memory and execute arbitrary code in kernel context. The result of executing an arbitrary kernel code is privilege escalation.

tags | advisory, arbitrary, kernel, local
systems | freebsd
advisories | CVE-2016-1886
MD5 | db2cefadc213a78dbd47951a813ce706
FreeBSD Security Advisory - FreeBSD-SA-16:17.openssl
Posted May 5, 2016
Authored by OpenSSL Project | Site security.freebsd.org

FreeBSD Security Advisory - The padding check in AES-NI CBC MAC was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. [CVE-2016-2107] An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. [CVE-2016-2105] An overflow can occur in the EVP_EncryptUpdate() function, however it is believed that there can be no overflows in internal code due to this problem. [CVE-2016-2106] When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can casuse allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. [CVE-2016-2109] ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. [CVE-2016-2176] FreeBSD does not run on any EBCDIC systems and therefore is not affected. A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. [CVE-2016-2107] If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. [CVE-2016-2105] Any application parsing untrusted data through d2i BIO functions are vulnerable to memory exhaustion attack. [CVE-2016-2109] TLS applications are not affected.

tags | advisory, overflow
systems | freebsd
advisories | CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109
MD5 | 0cd350926d2b0a4e5eb3cc47ba9a5d7d
FreeBSD Kernel amd64_set_ldt Heap Overflow
Posted Mar 17, 2016
Authored by Core Security Technologies, Francisco Falcon

Core Security Technologies Advisory - An integer signedness error has been found in the amd64_set_ldt() function in the FreeBSD kernel code (define d in the /sys/amd64/amd64/sys_machdep.c file), which implements the i386_set_ldt system call on the amd64 version of the OS. This integer signedness issue ultimately leads to a heap overflow in the kernel, allowing local unprivileged attackers to crash the system. FreeBSD 10.2 amd64 is affected.

tags | exploit, overflow, kernel
systems | freebsd, bsd
advisories | CVE-2016-1885
MD5 | 5fddced07d5ad899ebb2d9c6bf48f392
FreeBSD Security Advisory - FreeBSD-SA-16:15.sysarch
Posted Mar 17, 2016
Authored by Core Security Technologies | Site security.freebsd.org

FreeBSD Security Advisory - A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to invalid use of a signed intermediate value in the bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode. This vulnerability could cause the kernel to panic. In addition it is possible to perform a local Denial of Service against the system by unprivileged processes.

tags | advisory, denial of service, kernel, local
systems | freebsd
advisories | CVE-2016-1885
MD5 | 708f3ca1de7547e635db4e1854a95614
FreeBSD Security Advisory - FreeBSD-SA-16:14.openssh
Posted Mar 17, 2016
Site security.freebsd.org

FreeBSD Security Advisory - Due to insufficient input validation in OpenSSH, a client which has permission to establish X11 forwarding sessions to a server can piggyback arbitrary shell commands on the data intended to be passed to the xauth tool. An attacker with valid credentials and permission to establish X11 forwarding sessions can bypass other restrictions which may have been placed on their account, for instance using ForceCommand directives in the server's configuration file.

tags | advisory, arbitrary, shell
systems | freebsd
advisories | CVE-2016-3115
MD5 | 46da5195f39572d7796a4a8faa2321a1
FreeBSD Security Advisory - FreeBSD-SA-16:12.openssl
Posted Mar 14, 2016
Authored by OpenSSL Project | Site security.freebsd.org

FreeBSD Security Advisory - A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP3) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN. Various other issues were also addressed.

tags | advisory, imap, protocol
systems | freebsd, bsd
advisories | CVE-2016-0702, CVE-2016-0703, CVE-2016-0704, CVE-2016-0705
MD5 | 9ba68b8ddba8c9076b272b296999095c
FreeBSD Security Advisory - FreeBSD-SA-16:13.bind
Posted Mar 14, 2016
Authored by ISC | Site security.freebsd.org

FreeBSD Security Advisory - Testing by ISC has uncovered a defect in control channel input handling which can cause named to exit due to an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's control channel (the interface which allows named to be controlled using the "rndc" server control utility). An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. A remote attacker can deliberately trigger the failed assertion if the DNS server accepts remote rndc commands regardless if authentication is configured. Note that this is not enabled by default. A remote attacker who can cause a server to make a query deliberately chosen to generate a response containing a signature record which would trigger a failed assertion and cause named to stop. Disabling DNSsec does not provide protection against this vulnerability.

tags | advisory, remote
systems | freebsd, bsd
advisories | CVE-2016-1285, CVE-2016-1286
MD5 | e2321efbb6ba00455dca96e0e88d2409
FreeBSD Security Advisory - FreeBSD-SA-16:11.openssl
Posted Jan 31, 2016
Site security.freebsd.org

FreeBSD Security Advisory - A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2. An active MITM attacker may be able to force a protocol downgrade to SSLv2, which is a flawed protocol and intercept the communication between client and server.

tags | advisory, protocol
systems | freebsd
advisories | CVE-2015-3197
MD5 | 105c5b4a34e39afed10e9bbc94054342
FreeBSD Security Advisory - FreeBSD-SA-16:10.linux
Posted Jan 27, 2016
Authored by Isaac Dunham, Brent Cook, Warner Losh | Site security.freebsd.org

FreeBSD Security Advisory - A programming error in the Linux compatibility layer could cause the issetugid(2) system call to return incorrect information. If an application relies on output of the issetugid(2) system call and that information is incorrect, this could lead to a privilege escalation.

tags | advisory
systems | linux, freebsd
advisories | CVE-2016-1883
MD5 | 00d34015638239c7b35d55fdff5be632
FreeBSD Security Advisory - FreeBSD-SA-16:09.ntp
Posted Jan 27, 2016
Authored by Cisco ASIG / Network Time Foundation | Site security.freebsd.org

FreeBSD Security Advisory - Multiple vulnerabilities have been discovered in ntp 4.2.8p5.

tags | advisory, vulnerability
systems | freebsd, bsd
advisories | CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976
MD5 | 050d44ff421cf4c2ff19f2d29927a634
FreeBSD Security Advisory - FreeBSD-SA-16:08.bind
Posted Jan 27, 2016
Authored by ISC | Site security.freebsd.org

FreeBSD Security Advisory - There is an off-by-one error in a buffer size check when performing certain string formatting operations. Slaves using text-format db files could be vulnerable if receiving a malformed record in a zone transfer from their master. Masters using text-format db files could be vulnerable if they accept a malformed record in a DDNS update message. Recursive resolvers are potentially vulnerable when debug logging is enabled and if they are fed a deliberately malformed record by a malicious server. A server which has cached a specially constructed record could encounter this condition while performing 'rndc dumpdb'.

tags | advisory
systems | freebsd
advisories | CVE-2015-8704
MD5 | 58ee0826c7ba3739bb2d731b7fc83928
FreeBSD SCTP ICMPv6 Denial Of Service
Posted Jan 25, 2016
Site ptsecurity.com

FreeBSD suffers from an SCTP ICMPv6 error processing denial of service vulnerability.

tags | exploit, denial of service
systems | freebsd, bsd
advisories | CVE-2016-1879
MD5 | eb3cb9e922b8db018b68af99a333b2b9
FreeBSD bsnmpd Information Disclosure
Posted Jan 16, 2016
Authored by Pierre Kim

FreeBSD suffers from a bsnmpd information disclosure vulnerability.

tags | exploit, info disclosure
systems | freebsd, bsd
advisories | CVE-2015-5677
MD5 | 7d1a99c3863b05856f67c2ccb39b1ae2
FreeBSD Security Advisory - FreeBSD-SA-16:07.openssh
Posted Jan 15, 2016
Authored by Qualys Security Advisory Team | Site security.freebsd.org

FreeBSD Security Advisory - The OpenSSH client code contains experimental support for resuming SSH connections (roaming). The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys. A user that authenticates to a malicious or compromised server may reveal private data, including the private SSH key of the user.

tags | advisory
systems | freebsd
advisories | CVE-2016-0777
MD5 | db88bcb6e48b14664b5ad70f4388c83d
FreeBSD Security Advisory - FreeBSD-SA-16:06.bsnmpd
Posted Jan 15, 2016
Authored by Pierre Kim

FreeBSD Security Advisory - The SNMP protocol supports an authentication model called USM, which relies on a shared secret. The default permission of the bsnmpd configuration file, /etc/bsnmpd.conf, is weak and does not provide adequate protection against local unprivileged users. A local user may be able to read the shared secret, if configured and used by the system administrator.

tags | advisory, local, protocol
systems | freebsd
advisories | CVE-2015-5677
MD5 | fc7515d3e9f8630afb77d28bd7a61646
FreeBSD Security Advisory - FreeBSD-SA-16:01.sctp
Posted Jan 15, 2016
Authored by Jonathan T. Looney

FreeBSD Security Advisory - A lack of proper input checks in the ICMPv6 processing in the SCTP stack can lead to either a failed kernel assertion or to a NULL pointer dereference. In either case, a kernel panic will follow. A remote, unauthenticated attacker can reliably trigger a kernel panic in a vulnerable system running IPv6. Any kernel compiled with both IPv6 and SCTP support is vulnerable. There is no requirement to have an SCTP socket open. IPv4 ICMP processing is not impacted by this vulnerability.

tags | advisory, remote, kernel
systems | freebsd
advisories | CVE-2016-1879
MD5 | a52cfa43c6209a4b31e2e6e7ad10ffca
FreeBSD Security Advisory - FreeBSD-SA-16:02.ntp
Posted Jan 15, 2016
Authored by Network Time Foundation

FreeBSD Security Advisory - The ntpd(8) daemon has a safety feature to prevent excessive stepping of the clock called the "panic threshold". If ever ntpd(8) determines the system clock is incorrect by more than this threshold, the daemon exits. There is an implementation error within the ntpd(8) implementation of this feature, which allows the system time be adjusted in certain circumstances. When ntpd(8) is started with the '-g' option specified, the system time will be corrected regardless of if the time offset exceeds the panic threshold (by default, 1000 seconds). The FreeBSD rc(8) subsystem allows specifying the '-g' option by either including '-g' in the ntpd_flags list or by enabling ntpd_sync_on_start in the system rc.conf(5) file. If at the moment ntpd(8) is restarted, an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd(8) to set the time to an arbitrary value.

tags | advisory, arbitrary
systems | freebsd
advisories | CVE-2015-5300
MD5 | e07f765ea6647a5883adc34978841734
FreeBSD Security Advisory - FreeBSD-SA-16:05.tcp
Posted Jan 15, 2016
Authored by Ryan Stone,

FreeBSD Security Advisory - A programming error in processing a TCP connection with both TCP_MD5SIG and TCP_NOOPT socket options may lead to kernel crash. A local attacker can crash the kernel, resulting in a denial-of-service. A remote attack is theoretically possible, if server has a listening socket with TCP_NOOPT set, and server is either out of SYN cache entries, or SYN cache is disabled by configuration.

tags | advisory, remote, kernel, local, tcp
systems | freebsd
advisories | CVE-2016-1882
MD5 | 12d51fd2729f1bed2be6f8dc0ef11a09
FreeBSD Security Advisory - FreeBSD-SA-16:03.linux
Posted Jan 15, 2016
Authored by Mateusz Guzik

FreeBSD Security Advisory - A programming error in the handling of Linux futex robust lists may result in incorrect memory locations being accessed. It is possible for a local attacker to read portions of kernel memory, which may result in a privilege escalation.

tags | advisory, kernel, local
systems | linux, freebsd
advisories | CVE-2016-1880
MD5 | 19a4fbae13440bc000d627d27942b0ed
FreeBSD Security Advisory - FreeBSD-SA-16:04.linux
Posted Jan 15, 2016
Authored by Dmitry Chagin

FreeBSD Security Advisory - A programming error in the Linux compatibility layer setgroups(2) system call can lead to an unexpected results, such as overwriting random kernel memory contents. It is possible for a local attacker to overwrite portions of kernel memory, which may result in a privilege escalation or cause a system panic.

tags | advisory, kernel, local
systems | linux, freebsd
advisories | CVE-2016-1881
MD5 | 9ab82b9be2871f73b833b0650d17e096
FreeBSD Security Advisory - BIND Denial Of Service
Posted Dec 16, 2015
Site security.freebsd.org

FreeBSD Security Advisory - An error in the parsing of incoming responses allows some records with an incorrect class to be be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. An attacker who can cause a server to request a record with a malformed class attribute can use this bug to trigger a REQUIRE assertion in db.c, causing named to exit and denying service to clients. The risk to recursive servers is high. Authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs.

tags | advisory
systems | freebsd
advisories | CVE-2015-8000
MD5 | 06a85ebaa8919f1b808bbd7331ec41b8
FreeBSD Security Advisory - OpenSSL Issues
Posted Dec 6, 2015
Site security.freebsd.org

FreeBSD Security Advisory - OpenSSL has had multiple vulnerabilities addressed. The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. When presented with a malformed X509_ATTRIBUTE structure, OpenSSL will leak memory. If PSK identity hints are received by a multi-threaded client then the values are incorrectly updated in the parent SSL_CTX structure.

tags | advisory
systems | freebsd
advisories | CVE-2015-3194, CVE-2015-3195, CVE-2015-3196
MD5 | 0ced99acb2a23bfd013e2e6894d43ce7
FreeBSD Security Advisory - ntp Authentication Bypass
Posted Oct 26, 2015
Site security.freebsd.org

FreeBSD Security Advisory - Crypto-NAK packets can be used to cause ntpd(8) to accept time from an unauthenticated ephemeral symmetric peer by bypassing the authentication required to mobilize peer associations. FreeBSD 9.3 and 10.1 are not affected. Various other issues have also been addressed.

tags | advisory, crypto
systems | freebsd
advisories | CVE-2015-7701, CVE-2015-7702, CVE-2015-7703, CVE-2015-7704, CVE-2015-7848, CVE-2015-7849, CVE-2015-7850, CVE-2015-7851, CVE-2015-7852, CVE-2015-7853, CVE-2015-7854, CVE-2015-7855, CVE-2015-7871
MD5 | ad57d8b6fd48b773d3e8e84c18d972e4
FreeBSD Security Advisory - rpcbind(8) Denial Of Service
Posted Sep 30, 2015
Site security.freebsd.org

FreeBSD Security Advisory - In rpcbind(8), netbuf structures are copied directly, which would result in two netbuf structures that reference to one shared address buffer. When one of the two netbuf structures is freed, access to the other netbuf structure would result in an undefined result that may crash the rpcbind(8) daemon. A remote attacker who can send specifically crafted packets to the rpcbind(8) daemon can cause it to crash, resulting in a denial of service condition.

tags | advisory, remote, denial of service
systems | freebsd
advisories | CVE-2015-7236
MD5 | 85136eada6303b10454b9288940958f4
FreeBSD Security Advisory - BIND Denial Of Service
Posted Sep 2, 2015
Site security.freebsd.org

FreeBSD Security Advisory - Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. A remote attacker can deliberately trigger the failed assertion which will cause an affected server to terminate, by using a query that requires a response from a zone containing a malformed key, resulting in a denial of service condition. Recursive servers are at greatest risk, however, an authoritative server could also be affected, if an attacker controls a zone that the server must query against to perform its zone service.

tags | advisory, remote, denial of service
systems | freebsd
advisories | CVE-2015-5722
MD5 | 2223cf4358d2bd313c49a41886d70f86
Page 2 of 48
Back12345Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    16 Files
  • 20
    Feb 20th
    11 Files
  • 21
    Feb 21st
    3 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close