A vulnerability has been reported in NetBSD, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a boundary error in the SHA2 implementation and can be exploited to cause a buffer overflow with 4 or 8 constant bytes.

NOTE: This results in a heap-based buffer overflow in the libssh library and in a stack-based buffer overflow in pkg_install.

Solution
Fixed in the CVS repository. See vendor advisory for details.

Provided and/or discovered by
The vendor credits Joerg Sonnenberger.

Original Advisory
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-012.txt.asc

Deep Links
Links available in Customer Area