PT-2014-8549 · Freebsd · Freebsd

Publicado 2014-11-13 · Atualizado 2014-11-14 · CVE-2014-8476

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.4 through 10.1-RC4

Description The issue concerns the setlogin function, which fails to initialize a buffer used for storing the login name. This allows local users to access sensitive information from kernel memory by calling the getlogin function, which returns the entire buffer.

Recommendations For FreeBSD versions 8.4 through 10.1-RC4, consider restricting access to the setlogin function and getlogin function until a proper fix is applied. As a temporary workaround, avoid using the getlogin function to minimize the risk of sensitive information disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-8476

DSA-3070-1

Produtos afetados

Freebsd

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-8476 · Nota de Segurança
• http://debian.org/security/2014/dsa-3070 · Aviso do Fabricante
• http://secunia.com/advisories/62218 · Nota
• https://freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc · Aviso do Fabricante
• http://secunia.com/advisories/61118 · Nota