PT-2008-2395 · Freebsd · Freebsd

Kostik Belousov · Publicado 2008-02-15 · Atualizado 2008-09-05 · CVE-2008-0777

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 5.5 through 7.0

Description The issue concerns the sendfile system call, which does not properly check the access flags of the file descriptor used for sending a file. This allows local users to read the contents of files that are supposed to be write-only.

Recommendations For versions 5.5 through 7.0, update to a version that includes a fix for this issue, as the current version allows unauthorized access to file contents.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0777

Produtos afetados

Freebsd

Referências · 5

• 🔥 http://securityfocus.com/bid/27789 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0777 · Nota de Segurança
• http://security.freebsd.org/advisories/FreeBSD-SA-08:03.sendfile.asc · Correção, Aviso do Fabricante
• http://securitytracker.com/id?1019416 · Nota
• http://secunia.com/advisories/28928 · Aviso do Fabricante