CVE-2000-0489: Low severity NetBSD NetBSD vulnerability
FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure kernel/sysctl or other supported system settings to restrict the maximum socket send/receive buffer sizes so setsockopt cannot allocate excessively large buffers.
BSD kernel (socket buffer limits) maximum socket buffer size (SO_SNDBUF/SO_RCVBUF) = enforce an upper bound / reduce to a reasonable maximum - Configuration
Configure per-user and per-process resource limits (for example via shell limits or BSD resource limit mechanisms) to cap the number of sockets or file descriptors and prevent creation of a very large number of socket pairs.
System resource limits per-user / per-process number of open sockets / file descriptors = set a reasonable cap - Compensating control
Isolate untrusted or exposed workloads (jails/containers/VMs) and restrict network exposure; implement monitoring and alerting for abnormal socket creation or high socket buffer allocations and block or throttle offending sources at the network edge.
- Operational
Monitor systems for resource exhaustion due to excessive socketpair creation, terminate or throttle offending processes to reclaim resources, and apply vendor-supplied patches or fixes as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0489?
CVE-2000-0489 has been classified as a denial of service vulnerability affecting multiple BSD operating systems.
How do I fix CVE-2000-0489?
To fix CVE-2000-0489, you should update your FreeBSD, NetBSD, or OpenBSD systems to a version that addresses this vulnerability.
Which operating systems are affected by CVE-2000-0489?
CVE-2000-0489 affects FreeBSD, NetBSD, and OpenBSD, specifically older versions like FreeBSD 3.x and various NetBSD releases.
What is the impact of exploiting CVE-2000-0489?
Exploiting CVE-2000-0489 can lead to a denial of service condition, disrupting the availability of the affected system.
Is CVE-2000-0489 still a concern today?
While CVE-2000-0489 targets older operating systems, it remains a concern for systems that have not been updated or are still in use.