CVE-1999-0304: High severity NetBSD NetBSD vulnerability
mmap function in BSD allows local attackers in the kmem group to modify memory through devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove all non-administrative and untrusted users from the 'kmem' group so only trusted administrators retain membership. Update group membership policies to require justification and approval before adding accounts.
BSD 'kmem' group membership = trusted-administrators-only - Compensating control
Restrict access to device interfaces that permit modifying system memory by tightening file permissions and access controls on those device nodes so only trusted administrative accounts may open/mmap them. Use host-based access controls (e.g., mac/bsdext/ACLs) to limit which processes and users can access memory-capable devices.
- Operational
Audit current 'kmem' group membership and review system logs for recent use of device memory interfaces. Remove or disable any suspicious or unnecessary accounts and investigate any anomalous activity before restoring privileges.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0304?
The severity of CVE-1999-0304 is generally considered to be moderate due to the ability for local attackers in the kmem group to exploit memory modification vulnerabilities.
How do I fix CVE-1999-0304?
To fix CVE-1999-0304, it is advised to apply the latest available patches and updates for your specific BSD operating system version.
Who is affected by CVE-1999-0304?
CVE-1999-0304 affects systems running specific versions of NetBSD 2.0.4, OpenBSD 2.2, BSDi BSD OS 3.0, and FreeBSD 2.2.
What does CVE-1999-0304 allow an attacker to do?
CVE-1999-0304 allows local attackers within the kmem group to modify system memory through device access, posing a security risk.
Is CVE-1999-0304 a remote or local vulnerability?
CVE-1999-0304 is a local vulnerability, meaning it can only be exploited by users with local access to the affected systems.