SB2018091211 - Multiple vulnerabilities in FreeBSD

Description

This security bulletin contains information about 3 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2017-1083)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.

2) Buffer overflow (CVE-ID: CVE-2017-1084)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.

3) Buffer overflow (CVE-ID: CVE-2017-1085)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a local authenticated user to execute arbitrary code.

In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.

Remediation

Install update from vendor's website.

References

• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
• https://www.exploit-db.com/exploits/42277/
• https://www.exploit-db.com/exploits/42278/
• https://www.exploit-db.com/exploits/42279/