openbsd-libexec

OpenBSD libexec Audit Findings

Security audit of programs shipped under OpenBSD's libexec tree. These are not user-facing tools but helper binaries invoked by other parts of the system: BSD authentication helpers, the dynamic linker, RPC services, mail and spam infrastructure, and the traditional C preprocessor. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 17 -- High: 3, Medium: 14

Findings

BSD authentication helpers

#	Finding	Severity
001	Malformed challenge attribute causes backwards parser walk	High
002	Oversized State attribute leaks stack bytes	Medium
003	Unterminated response scans past stack buffer	Medium
004	YubiKey counter check updates non-atomically	High
009	Malformed LDAP control dereferences missing child elements	Medium
010	Malformed page control dereferences absent value element	Medium
011	Invalid encoded page control dereferences failed BER parse	Medium

Dynamic linker (ld.so)

#	Finding	Severity
012	ELF program headers read past fixed header buffer	Medium
013	ELF program headers are read past the header buffer	Medium
014	ELF without load segments dereferences null load list	Medium
018	Unchecked ELF relocation type indexes static tables	Medium

RPC services

#	Finding	Severity
005	Negative quota id leaks uninitialized quota reply fields	High
019	Legacy rusers reply uses wrong XDR type	Medium

Spam and mail infrastructure

#	Finding	Severity
006	Remote feed can force unbounded decompression	Medium

Network daemons

#	Finding	Severity
017	Client-controlled response address enables UDP reflection	Medium

Traditional C preprocessor

#	Finding	Severity
007	Signed division overflow in #if evaluator	Medium
008	Signed remainder overflow in #if evaluator	Medium