Lucene search

K
freebsdFreeBSD78992249-947C-11EA-92AB-00163E433440
HistoryMay 12, 2020 - 12:00 a.m.

FreeBSD -- Memory disclosure vulnerability in libalias

2020-05-1200:00:00
vuxml.freebsd.org
8

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

28.4%

Problem Description:
The FTP packet handler in libalias incorrectly calculates some packet
lengths. This may result in disclosing small amounts of memory from the
kernel (for the in-kernel NAT implementation) or from the process space for
natd (for the userspace implementation).
Impact:
A malicious attacker could send specially constructed packets that exploit the
erroneous calculation allowing the attacker to disclose small amount of memory
either from the kernel (for the in-kernel NAT implementation) or from the
process space for natd (for the userspace implementation).

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd-kernel= 12.1UNKNOWN
FreeBSDanynoarchfreebsd-kernel< 12.1_5UNKNOWN

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

28.4%

Related for 78992249-947C-11EA-92AB-00163E433440