Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Netbsd | Netbsd | * | 5.0.2 (including) |
| Netbsd | Netbsd | 0.8 (including) | 0.8 (including) |
| Netbsd | Netbsd | 0.9 (including) | 0.9 (including) |
| Netbsd | Netbsd | 1.0 (including) | 1.0 (including) |
| Netbsd | Netbsd | 1.1 (including) | 1.1 (including) |
| Netbsd | Netbsd | 1.2 (including) | 1.2 (including) |
| Netbsd | Netbsd | 1.2.1 (including) | 1.2.1 (including) |
| Netbsd | Netbsd | 1.3 (including) | 1.3 (including) |
| Netbsd | Netbsd | 1.3.1 (including) | 1.3.1 (including) |
| Netbsd | Netbsd | 1.3.2 (including) | 1.3.2 (including) |
| Netbsd | Netbsd | 1.3.3 (including) | 1.3.3 (including) |
| Netbsd | Netbsd | 1.4 (including) | 1.4 (including) |
| Netbsd | Netbsd | 1.4.1 (including) | 1.4.1 (including) |
| Netbsd | Netbsd | 1.4.2 (including) | 1.4.2 (including) |
| Netbsd | Netbsd | 1.4.3 (including) | 1.4.3 (including) |
| Netbsd | Netbsd | 1.5 (including) | 1.5 (including) |
| Netbsd | Netbsd | 1.5.1 (including) | 1.5.1 (including) |
| Netbsd | Netbsd | 1.5.2 (including) | 1.5.2 (including) |
| Netbsd | Netbsd | 1.5.3 (including) | 1.5.3 (including) |
| Netbsd | Netbsd | 1.6 (including) | 1.6 (including) |
| Netbsd | Netbsd | 1.6-beta (including) | 1.6-beta (including) |
| Netbsd | Netbsd | 1.6.1 (including) | 1.6.1 (including) |
| Netbsd | Netbsd | 1.6.2 (including) | 1.6.2 (including) |
| Netbsd | Netbsd | 2.0 (including) | 2.0 (including) |
| Netbsd | Netbsd | 2.0.1 (including) | 2.0.1 (including) |
| Netbsd | Netbsd | 2.0.2 (including) | 2.0.2 (including) |
| Netbsd | Netbsd | 2.0.3 (including) | 2.0.3 (including) |
| Netbsd | Netbsd | 2.0.4 (including) | 2.0.4 (including) |
| Netbsd | Netbsd | 2.1 (including) | 2.1 (including) |
| Netbsd | Netbsd | 2.1.1 (including) | 2.1.1 (including) |
| Netbsd | Netbsd | 3.0 (including) | 3.0 (including) |
| Netbsd | Netbsd | 3.0.1 (including) | 3.0.1 (including) |
| Netbsd | Netbsd | 3.0.2 (including) | 3.0.2 (including) |
| Netbsd | Netbsd | 3.1 (including) | 3.1 (including) |
| Netbsd | Netbsd | 3.99.15 (including) | 3.99.15 (including) |
| Netbsd | Netbsd | 4.0-beta (including) | 4.0-beta (including) |
| Netbsd | Netbsd | 4.0-beta2 (including) | 4.0-beta2 (including) |
| Netbsd | Netbsd | 4.0.1 (including) | 4.0.1 (including) |
| Netbsd | Netbsd | 5.0 (including) | 5.0 (including) |
| Netbsd | Netbsd | 5.0.1 (including) | 5.0.1 (including) |