Secunia

Description

Different problems have been identified in the kernel sysctl code, which can lead to exposure of sensitive information or cause a Denial of Service.

Users may be able to cause a NULL pointer dereference because a pointer variable is used for both user-level and kernel addresses. This could possibly be exploited to cause a kernel panic.

Users may be able to invoke the proc.* sysctl tree on a zombie process. This would cause the kernel to dereference invalid process data resulting in a kernel panic.

The sysctl helper performs an insufficient range check for certain sysctl nodes under the proc.curproc.rlimit subtree. This could be exploited to read arbitrary kernel memory space.

Affected versions:
NetBSD-current: source prior to August 25, 2003
NetBSD 1.6.1
NetBSD 1.6
NetBSD-1.5.3
NetBSD-1.5.2
NetBSD-1.5.1
NetBSD-1.5

Solution
Fixed versions:
Further details available in Customer Area

Original Advisory
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-014.txt.asc

Deep Links
Links available in Customer Area