FreeBSD : tarsnap -- buffer overflow and local DoS (2fe40238-480f-11e5-adde-14dae9d210b8)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

Colin Percival reports :

1. SECURITY FIX: When constructing paths of objects being archived, a
buffer could overflow by one byte upon encountering 1024, 2048, 4096,
etc. byte paths. Theoretically this could be exploited by an
unprivileged user whose files are being archived; I do not believe it
is exploitable in practice, but I am offering a $1000 bounty for the
first person who can prove me wrong :
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty
.html

2. SECURITY FIX: An attacker with a machine's write keys, or with read
keys and control of the tarsnap service, could make tarsnap allocate a
large amount of memory upon listing archives or reading an archive the
attacker created; on 32-bit machines, tarsnap can be caused to crash
under the aforementioned conditions.

See also :

http://mail.tarsnap.com/tarsnap-announce/msg00032.html
http://www.nessus.org/u?976e149f
http://www.nessus.org/u?b170cde2

Solution :

Update the affected package.

Risk factor :

High

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 85595 ()

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now