OpenBSD Security Advisory: Select Boundary Condition (fwd)

From: Jonas Eriksson (jeat_private)
Date: Mon Aug 12 2002 - 13:18:51 PDT

Next message: Thomas C. Greene: "Re: IE SSL Vulnerability (Konqueror affected too)"

Previous message: Mike Benham: "IE SSL Exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

---------- Forwarded message ----------
Date: Sun, 11 Aug 2002 17:09:03 -0400
From: Niels Provos <provosat_private>
To: security-announceat_private, announceat_private, miscat_private
Subject: OpenBSD Security Advisory: Select Boundary Condition

-----BEGIN PGP SIGNED MESSAGE-----

OpenBSD Security Advisory (adv.select)
Original Release Date: 2002-08-11

1. Systems affected:

        All versions of OpenBSD.

2. Overview:

	Insufficient boundary checks in the select call allow an
	attacker to overwrite kernel memory and execute arbitrary code
	in kernel context.

	Traditionally, the size parameter for the select system call
	is a signed integer.  As a result, the kernel evaluates the
	upper boundary checks in a signed context, so that an attacker
	can circumvent when using certain negative values.

	When the kernel copies the data for the select system call
	from userland the size is used as an unsigned integer which
	causes kernel memory to be overwritten with arbitrary data.

2. Impact:

        Local users can obtain complete system privileges and
        circumvent the extra security measures provided by the
        securelevel system.

3. Solution:

        Apply one of the supplied kernel patches or update to
        3.0-stable or 3.1-stable from 2002-08-11 17:00 EDT or later.

4. Patch:

	ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/014_scarg.patch

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iQEVAwUBPVbSKDZ8FqYKL4flAQGGTAgAoRmp24ZjsC3opJvaHe5I2T3smBIxwfCQ
jfuQQmxKstnOf9mgvEunkdoMDuuksNlWX13skLoTm0c0mvjFTp2ctRdUH/o0rHdj
Ya8nFmkTaG98hOv73AcKN+7xG1j6I0v6tvifZqOoIUGTed76CYfSIH7Xtblmy0fl
1vgMsuKVXUQu+Db3+zBw1XY6ke6YtK1cgVaJjbfjdpiS9yOHCun4fvGvIkWdqGmH
QFT928uzAKLnz1kieynTGLVMOHgt064mV6MjDrYpqu4hUo9UVREaVOrHb6aEOpi+
VeicbnT+OWn7EdGsKiS14YajXj/UuE5bdz2gCV/QU4zGiwnLXfBfMQ==
=MHDm
-----END PGP SIGNATURE-----

Next message: Thomas C. Greene: "Re: IE SSL Vulnerability (Konqueror affected too)"
Previous message: Mike Benham: "IE SSL Exploit"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Aug 12 2002 - 16:13:48 PDT