PT-2013-5744 · Freebsd · Freebsd

Publicado 2013-09-23 · Atualizado 2013-10-24 · CVE-2013-5710

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 9.2

Description The issue concerns the nullfs implementation in the kernel, specifically in sys/fs/nullfs/null vnops.c. It allows local users with certain permissions to bypass access restrictions. This is achieved by creating a hardlink in a nullfs instance to a file in a different instance.

Recommendations For FreeBSD versions 8.3 through 9.2, consider restricting access to nullfs instances to minimize the risk of exploitation. As a temporary workaround, limit the ability of local users to create hardlinks between different nullfs instances until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-5710

DSA-2769-1

Produtos afetados

Freebsd

Referências · 6

• http://securitytracker.com/id/1029015 · Nota
• http://secunia.com/advisories/54861 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5710 · Nota de Segurança
• http://debian.org/security/2013/dsa-2769 · Aviso do Fabricante
• http://freebsd.org/security/advisories/FreeBSD-SA-13:13.nullfs.asc · Aviso do Fabricante
• http://svnweb.freebsd.org/base?view=revision&revision=255442 · Nota