FreeBSD : FreeBSD -- libfetch out of bounds read (d22b336d-0567-11ec-b69d-4062311215d5)

critical Nessus Plugin ID 152857

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for *p == '\0' one byte too late because p++ was already performed. Impact : The connection buffer size can be controlled by a malicious FTP server because the size is increased until a newline is encountered (or no more characters are read). This also allows to move the buffer into more interesting areas within the address space, potentially parsing relevant numbers for the attacker.
Since these bytes become available to the server in form of a new TCP connection to a constructed port number or even part of the IPv6 address this is a potential information leak.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 152857

File Name: freebsd_pkg_d22b336d056711ecb69d4062311215d5.nasl

Version: 1.3

Type: local

Family: FreeBSD Local Security Checks

Published: 8/26/2021

Updated: 12/1/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2021-36159

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:freebsd, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/25/2021

Vulnerability Publication Date: 8/24/2021

Reference Information

CVE: CVE-2021-36159

FreeBSD: SA-21:15.libfetch

Detections

Analytics