Freely subscribe to our NEWSLETTER

Severity: 1/4

Consequences: denial of service of computer, denial of service of service

Provenance: user shell

Means of attack: 1 attack

Ability of attacker: technician (2/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: high (3/3)

Creation date: 24/06/2009

IMPACTED PRODUCTS

 NetBSD

DESCRIPTION OF THE VULNERABILITY

The proplib library is used to manipulate property lists (plist), using booleans (true, false), integers (integer, real) or strings (string), stored in an XML tree.

The _prop_object_internalize_by_tag() function of the src/common/lib/libprop/prop_object.c file reads XML tags. However, when an XML tag is not standard (such as ""), this function dereferences the poi->poi_tag pointer which is NULL. This error stops the program.

A local attacker can therefore stop applications or drivers using proplib.

CHARACTERISTICS

Identifiers: BID-35466, NetBSD-SA2009-003, VIGILANCE-VUL-8819

http://vigilance.fr/vulnerability/NetBSD-denial-of-service-via-proplib-8819