Information disclosure in FreeBSD

1) Information disclosure

EUVDB-ID: #VU30574

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2480

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

FreeBSD: 8.0 - 8.1

External links

http://access.redhat.com/security/cve/cve-2011-2480
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631160
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631161
http://security-tracker.debian.org/tracker/CVE-2011-2480
http://www.openwall.com/lists/oss-security/2011/06/20/15

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.