PT-2010-3641 · Freebsd · Freebsd

Aaron D. Gifford · Publicado 2010-05-28 · Atualizado 2010-06-01 · CVE-2010-2022

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.0 through 8.1-PRERELEASE

Description The issue is related to the jail.c component in FreeBSD, where it fails to properly restrict access to the current working directory when specific options are omitted. This could potentially allow local users to perform unauthorized filesystem operations, such as reading, modifying, or creating arbitrary files.

Recommendations For FreeBSD versions 8.0 through 8.1-PRERELEASE, consider restricting access to the jail.c component until a proper fix is applied, by using the "-l -U root" options to ensure proper access control.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2022

Produtos afetados

Freebsd

Referências · 5

• http://securityfocus.com/bid/40399 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2022 · Nota de Segurança
• http://vupen.com/english/advisories/2010/1247 · Aviso do Fabricante
• http://security.freebsd.org/advisories/FreeBSD-SA-10:04.jail.asc · Aviso do Fabricante
• http://securitytracker.com/id?1024038 · Nota