FreeBSD : tarsnap -- buffer overflow and local DoS (2fe40238-480f-11e5-adde-14dae9d210b8)

high Nessus Plugin ID 85595

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Colin Percival reports :

1. SECURITY FIX: When constructing paths of objects being archived, a buffer could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte paths. Theoretically this could be exploited by an unprivileged user whose files are being archived; I do not believe it is exploitable in practice, but I am offering a $1000 bounty for the first person who can prove me wrong :
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty .html

2. SECURITY FIX: An attacker with a machine's write keys, or with read keys and control of the tarsnap service, could make tarsnap allocate a large amount of memory upon listing archives or reading an archive the attacker created; on 32-bit machines, tarsnap can be caused to crash under the aforementioned conditions.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 85595

File Name: freebsd_pkg_2fe40238480f11e5adde14dae9d210b8.nasl

Version: 2.4

Type: local

Family: FreeBSD Local Security Checks

Published: 8/24/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:tarsnap, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 8/21/2015

Vulnerability Publication Date: 8/21/2015

Detections

Analytics