CVE-2017-1000372
CriticalSummary
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of OpenBSD and monitor systems for unauthorized changes to setuid files.
Other vulnerabilities in OpenBSD
See all- CVE-2026-56101Medium
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
- CVE-2026-57589High
In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().
- CVE-2026-56099Medium
A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
- CVE-2026-55706Medium
In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.
- CVE-2023-40216Medium
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
- CVE-1999-0481Medium
CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.
- CVE-1999-0485Low
Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
- CVE-1999-0062High
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Original NVD description (English source)
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.