Description
ipfw in FreeBSD 5.4, when running on Symmetric Multi-Processor (SMP) or Uni Processor (UP) systems with the PREEMPTION kernel option enabled, does not sufficiently lock certain resources while performing table lookups, which can cause the cache results to be corrupted during multiple concurrent lookups, allowing remote attackers to bypass intended access restrictions.
Product(s):
- FreeBSD 5.4
- FreeBSD 5.4 Patch 10
- FreeBSD 5.4 Patch 11
- FreeBSD 5.4 Patch 12
- FreeBSD 5.4 Patch 13
- FreeBSD 5.4 Patch 14
- FreeBSD 5.4 Patch 15
- FreeBSD 5.4 Patch 16
- FreeBSD 5.4 Patch 17
- FreeBSD 5.4 Patch 18
- FreeBSD 5.4 Patch 19
- FreeBSD 5.4 Patch 1
- FreeBSD 5.4 Patch 21
- FreeBSD 5.4 Patch 22
- FreeBSD 5.4 Patch 2
- FreeBSD 5.4 Patch 3
- FreeBSD 5.4 Patch 4
- FreeBSD 5.4 Patch 5
- FreeBSD 5.4 Patch 7
- FreeBSD 5.4 Patch 8
- FreeBSD 5.4 Patch 9
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2005-2019, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2005-2019 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.