Multiple integer signedness errors in smbsubr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOCLOOKUP or (2) SMBIOCOPENSESSION ioctl call.

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits.

A Debian bug report [1] noted that pmake (and mk-files in Fedora) contained the files /usr/share/mk/bsd.{lib,prog}.mk that created temporary files insecurely with predictable file names in /tmp (/tmp/depend[PID]), ignoring any $TMPDIR values.

In lib.mk:

446 afterdepend: .depend 447 @(TMP=/tmp/depend$$$$; \ 448 sed -e 's/^\([^\.]\).o[ ]:/\1.o \1.po \1.so \1.ln:/' \ 449 < .depend > $$TMP; \ 450 mv $$TMP .depend) 451 .endif

The same is found in prog.mk (in Fedora's mk-files package).

The Debian bug report proposes to use mktemp here:

- @(TMP=/tmp/depend$$$$; \ + @(TMP=mktemp -t dependXXXXXXXXXX || exit $$?; \

Upstream has already corrected this by removing the offending code [2],[3].

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 [2] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240 [3] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193