Multiple vulnerabilities in OpenBSD

1) Improper input validation

EUVDB-ID: #VU10424

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper input validation. A remote attacker can supply specially crafted IPsec AH packets with IP options or IPv6 extension and cause the kernel to crash or hang.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenBSD: 6.1 - 6.2

External links

http://www.openbsd.org/errata61.html
http://www.openbsd.org/errata62.html
http://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/034_ahopts.patch.sig

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU10425

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper input validation. A remote attacker can supply specially crafted IPv6 fragments, incorrectly access memory of an mbuf chain that is not within an mbuf and cause the kernel to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenBSD: 6.1 - 6.2

External links

http://www.openbsd.org/errata61.html
http://www.openbsd.org/errata62.html
http://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/035_prevhdr.patch.sig

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Double free

EUVDB-ID: #VU10426

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to the EtherIP tunnel protocol was disabled. A remote attacker can trigger improper discarding of IPv6 packets and double free error to cause the kernel to crash. 

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenBSD: 6.1 - 6.2

External links

http://www.openbsd.org/errata61.html
http://www.openbsd.org/errata62.html
http://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/036_etherip.patch.sig

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Spoofing attack

EUVDB-ID: #VU10427

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The weakness exists due to a flaw in the way unbound validated wildcard-synthesized NSEC records. A remote attacker can supply a specially crafted wildcard NSEC record and prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenBSD: 6.2

External links

http://www.openbsd.org/errata62.html
http://ftp.openbsd.org/pub/OpenBSD/patches/6.2/common/008_unbound.patch.sig

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.