|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
BSD contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the exec system call fails to check the text size and data size in a header against the actual size of a file. If a malicious user creates an unreasonably large datasize, a core dump will result. This will disclose memory information resulting in a loss of confidentiality.
|
|
Classification |
Location:
Local Access Required
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: add a switch statement to the existing check code in /usr/sys/sys/kern_exec.c that will check text size and data size against the actual size of a file.
|
|
Products |
|
BSD
 |
4.2 |
|
|
|
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
