Heap-based Buffer Overflow in FreeBSD

Published: 2016-10-10 | Updated: 2016-10-11

Risk	High
Patch available	YES
Number of vulnerabilities	1
CVE-ID	N/A
CWE-ID	CWE-122
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	FreeBSD Operating systems & Components / Operating system
Vendor	FreeBSD Foundation

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Heap-based Buffer Overflow

EUVDB-ID: #VU825

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote anauthenticated user to execute arbitrary code or trigger DoS conditions on the target system.
The weakness is due to improper input validation by the bspatch utility. By installing or tricking the victim to upload a specially crafted patch file attackers can cause a heap overflow that may lead to system crash. Besides, a malicious user with elevated privileges can trigger arbitrary code execution on the vulnerable system.
Successful exploitation of the vulnerability allows remote attackers to compromise the system completely.

Mitigation

Update patched versions:
https://security.FreeBSD.org/patches/SA-16:29/bspatch.patch

Vulnerable software versions

FreeBSD: 9.3 - 11.0

External links

http://www.freebsd.org/security/advisories/FreeBSD-SA-16:29.bspatch.asc

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.