• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability

A buffer overrun has been discovered within the OpenBSD kernel when handling malformed COFF executables. The problem occurs when the kernel is carrying out a read operation on the binary file, incorrectly using the length parameter within the COFF header structure without first carryout out sanity checking. As a result, a malformed binary may be capable of triggering a stack overrun within the context of kernel memory. This vulnerability could potentially be exploited to gain elevated privileges on OpenBSD 2.x-3.3 systems. It has yet to be confirmed whether this is also possible on OpenBSD 3.4, however it is said to be possible to at least trigger a kernel panic.