PT-2010-2109 · Freebsd · Freebsd

Pawel Jakub Dawidek · Publicado 2010-01-15 · Atualizado 2011-08-08 · CVE-2010-0318

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 7.1 through 8.0

Description The issue affects the replay functionality for ZFS Intent Log (ZIL) in FreeBSD. When creating files during replay of a setattr transaction after a system crash or power failure, the functionality uses 7777 permissions instead of the original permissions. This might allow local users to read or modify unauthorized files in certain circumstances.

Recommendations For versions 7.1 through 8.0, update to a version that includes a fix for this issue to ensure that original file permissions are used during ZIL replay.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-0318

Produtos afetados

Freebsd

Referências · 5

• http://security.freebsd.org/advisories/FreeBSD-SA-10:03.zfs.asc · Aviso do Fabricante
• http://secunia.com/advisories/38124 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0318 · Nota de Segurança
• http://securitytracker.com/id?1023407 · Nota
• http://securityfocus.com/bid/37657 · Nota