PT-2002-1622 · Freebsd · Freebsd

Publicado 2002-06-11 · Atualizado 2018-10-30 · CVE-2002-0572

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 4.5 and earlier

Description The issue allows local users to access restricted files by manipulating file descriptors. This is done by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which can then be reused by a setuid process. This process intended to perform input/output operations on normal files, but due to the file descriptor manipulation, it may end up accessing restricted files instead.

Recommendations For FreeBSD versions 4.5 and earlier, consider updating to a newer version to mitigate the risk, as the exact fix or patch details are not specified. As a temporary workaround, consider restricting the use of setuid processes or implementing additional access controls to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-0572

Produtos afetados

Freebsd

Referências · 11

• 🔥 http://securityfocus.com/bid/4568 · Exploit
• 🔥 https://exploit-db.com/exploits/21407 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/268970 · Exploit
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0033.html · Nota
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc · Aviso do Fabricante
• http://osvdb.org/6095 · Nota
• http://kb.cert.org/vuls/id/809347 · Nota
• http://online.securityfocus.com/archive/1/269102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0572 · Nota de Segurança
• http://iss.net/security_center/static/8920.php · Nota
• http://ciac.org/ciac/bulletins/m-072.shtml · Nota