CVSS: 7.5EPSS: 2%CPEs: 9EXPL: 3CVE-2008-1391 – BSD (Multiple Distributions) - 'strfmon()' Integer Overflow
https://notcve.org/view.php?id=CVE-2008-1391
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec. Múltiples desbordamientos de entero en libc de NetBSD 4.x, FreeBSD 6.x y 7.x, y posiblemente otras plataformas BSD y Apple Mac OS permiten a atacantes dependientes del contexto ejecutar código de su elección a través de valores de ciertos campos de enteros en el argumento de formato de (1) la función strfmon en lib/libc/stdlib/strfmon.c, en relación a la macro GET_NUMBER; y (2) la función printf, en relación a left_prec y right_prec. • https://www.exploit-db.com/exploits/31550 http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/29574 http://secunia.com/advisories/33179 http://securityreason.com/achievement_securityalert/53 http://securityreason.com/securityalert/3770 http://support.apple.com/kb/HT3338 http://www.debian.org/security/2010/dsa-2058 http://www.securityfocus.com/archive/1/490 • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 0%CPEs: 14EXPL: 0CVE-2008-1335
https://notcve.org/view.php?id=CVE-2008-1335
The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a different vulnerability than CVE-2006-0905. La función ipsec4_get_ulp del kernel en las versiones 2.0 a 3.1 de NetBSD y NetBSD-current anterior a 20071028, cuando está habilitado el subsistema fast_ipsec, permite a atacantes remotos saltarse las restricciones de IPsec al enviar paquetes desde una máquina origen con diferente longitud de carácter que la máquina destino, siendo un vulnerabilidad diferente a CVE-2006-0905. • ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-002.txt.asc http://secunia.com/advisories/29180 http://securitytracker.com/id?1019533 http://www.securityfocus.com/bid/28045 •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 4CVE-2008-1215 – BSD PPP 'pppx.conf' - Local Denial of Service
https://notcve.org/view.php?id=CVE-2008-1215
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters. Desbordamiento de búfer basado en pila en la función command_Expand_Interpret de command.c en ppp (aka user-ppp), como se distribuyó en FreeBSD 6.3 y 7.0, OpenBSD 4.1 y 4.2, y el paquete net/userppp para NetBSD, permite a usuarios locales obtener privilegios a través de comandos largos que contienen los caracteres "~". • https://www.exploit-db.com/exploits/31333 http://secunia.com/advisories/29234 http://secunia.com/advisories/29238 http://secunia.com/advisories/29240 http://www.openbsd.org/errata41.html#014_ppp http://www.openbsd.org/errata42.html#009_ppp http://www.securityfocus.com/archive/82/488980/30/0/threaded http://www.securityfocus.com/archive/82/489031/30/0/threaded http://www.securityfocus.com/bid/28090 https://exchange.xforce.ibmcloud.com/vulnerabilities/41034 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 1%CPEs: 198EXPL: 0CVE-2008-1147
https://notcve.org/view.php?id=CVE-2008-1147
A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 2-bit random hops (aka "Algorithm X2"), as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as injection into TCP packets and OS fingerprinting. Cierto algoritmo generador de números pseudo-aleatorios(PRNG) que usa XOR y alterna en saltos de 2-bit (también conocido com o"algoritmo X2"), usado en OpenBSD de la v2.6 a la 3.4, Mac OS X de la v10 a a 10.5.1, FreeBSD 4.4 a la 7.0 y DragonFlyBSD 1.0 a la 1.10.1, permite a atacantes remotos adivinar datos sensibles como los IDs de una fragmentación IP observando una secuencia generada previamente. NOTA: este fallo puede ser aprovechado por ataques como la inyección de paquetes TCP y OS fingerprinting. • http://seclists.org/bugtraq/2008/Feb/0052.html http://seclists.org/bugtraq/2008/Feb/0063.html http://secunia.com/advisories/28819 http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/ip_id.c?rev=1.10%3Bcontenttype= http://www.securiteam.com/securityreviews/5PP0H0UNGW.html http://www.securityfocus.com/archive/1/487658 http://www.securityfocus.com/bid/27647 http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf https://e •
CVSS: 6.8EPSS: 1%CPEs: 198EXPL: 0CVE-2008-1148
https://notcve.org/view.php?id=CVE-2008-1148
A certain pseudo-random number generator (PRNG) algorithm that uses ADD with 0 random hops (aka "Algorithm A0"), as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as (1) DNS transaction IDs or (2) IP fragmentation IDs by observing a sequence of previously generated values. NOTE: this issue can be leveraged for attacks such as DNS cache poisoning, injection into TCP packets, and OS fingerprinting. Cierto algoritmo generador de números pseudo-aleatorios(PRNG) que usa ADD con 0 saltos aleatorios(también conocido como "algoritmo A0"), usado en OpenBSD de la v3.5 a la 4.2 y NetBSD v1.6.2 a la 4.0, permite a atacantes remotos adivinar datos sensibles como (1)los IDs de una transacción DNS, (2)IDs de una fragmentación IP observando una secuencias generadas previamente. NOTA: este fallo puede ser aprovechado por ataques como el envenenamiento de la cachés DNS, la inyección de paquetes TCP y OS fingerprinting. • http://secunia.com/advisories/28819 http://www.securiteam.com/securityreviews/5PP0H0UNGW.html http://www.securityfocus.com/archive/1/487658 http://www.securityfocus.com/bid/27647 http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/40329 https://exchange.xforce.ibmcloud.com/vulnerabilities/41157 •