CVE-2009-1436: Input Validation

Published Apr 27, 2009

Updated

The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to obtain sensitive information by reading a database file.

Affected Software

10 affected components

FreeBSD FreeBSD=6.3

FreeBSD FreeBSD=6.3-release_p10

FreeBSD FreeBSD=6.4

FreeBSD FreeBSD=6.4-release_p4

FreeBSD FreeBSD=6.4-stable

FreeBSD FreeBSD=7.0

FreeBSD FreeBSD=7.0-release-p12

FreeBSD FreeBSD=7.1

FreeBSD FreeBSD=7.1-release-p5

FreeBSD FreeBSD=7.2-pre-release

Remediation

Patch Available

http://www.securityfocus.com/bid/34666

Event History

Apr 27, 2009

CVE Published

via MITRE·05:43 PM

Data Sourced

via MITRE·05:43 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1436?

CVE-2009-1436 has a moderate severity level due to the potential for local users to access sensitive information.

How do I fix CVE-2009-1436?

To fix CVE-2009-1436, it is recommended to upgrade to a patched version of FreeBSD that addresses the memory initialization issue.

Which FreeBSD versions are affected by CVE-2009-1436?

CVE-2009-1436 affects FreeBSD versions 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE.

What type of vulnerability is CVE-2009-1436?

CVE-2009-1436 is a local information disclosure vulnerability stemming from improper memory initialization.

Who can exploit CVE-2009-1436?

CVE-2009-1436 can be exploited by local users who have access to read the affected database files.