CVE-2005-4352 - BSD SecureLevel Time Setting Security Restriction Bypass Vulnerability

Publication

2005-12-31

Last modification

2018-10-19

Summary

The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value (19 Jan 2038), which then wraps around to the minimum value (13 Dec 1901), which can then be set ahead to the desired time, aka "settimeofday() time wrap."

Description

BSD securelevels are prone to a security-restriction-bypass vulnerability that allows local attackers to set the system clock to any arbitrary value. An attacker can set the system clock to any arbitrary value, even to times in the past, circumventing the securelevel restriction. The attacker can then launch various further attacks against time-sensitive systems.

Solution

NetBSD has released advisory 2006-002 along with patches to address this issue. NetBSD CVS has had fixes committed to the repository since December 6, 2005. Please see the referenced advisories for information on obtaining and applying fixes. Linux kernel 2.6.11.4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test9-CVS Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test7 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test9 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6 -test10 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.1 -rc2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.10 rc2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.10 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.11 -rc3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.11 .11 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.11 .7 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.11 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.11 .6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 -rc4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .12 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .22 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 -rc1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.12 .3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.13 -rc4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.13 .3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.13 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.13 -rc7 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 .4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 .1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 .3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 -rc2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 .5 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.14 -rc3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 -rc6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 -rc1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 -rc3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 .4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 -rc4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.15 .6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .9 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .5 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .23 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 -rc1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 27 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 13 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .16 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.16 .11 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .5 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .7 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .13 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .10 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .9 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 -rc5 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .14 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.17 .6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.3 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.4 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.6 rc1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.6 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.7 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.8 rc2 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.8 rc1 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz Linux kernel 2.6.9 Linux linux-2.6.18.tar.gz http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz

Exploit

An exploit is not required.

Risk level (CVSS AV:L/AC:L/Au:N/C:N/I:P/A:N)

Low

2.1

Access Vector

  • Network
  • Adjacent Network
  • Local

Access Complexity

  • Low
  • Medium
  • High

Authentication

  • None
  • Single
  • Multiple

Confident. Impact

  • Complete
  • Partial
  • None

Integrity Impact

  • Complete
  • Partial
  • None