SB2018091211 - Multiple vulnerabilities in FreeBSD

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2017-1083)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.

2) Buffer overflow (CVE-ID: CVE-2017-1084)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.

3) Buffer overflow (CVE-ID: CVE-2017-1085)

The vulnerability allows a local authenticated user to execute arbitrary code.

In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.

Remediation

Install update from vendor's website.

References

• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
• https://www.exploit-db.com/exploits/42277/
• https://www.exploit-db.com/exploits/42278/
• https://www.exploit-db.com/exploits/42279/