PT-2015-4055 · Freebsd · Freebsd

Publicado 2015-02-02 · Atualizado 2018-10-09 · CVE-2014-8612

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.4 before p23 FreeBSD versions 9.3 before p9 FreeBSD versions 10.0 before p17 FreeBSD versions 10.1 before p5

Description The issue concerns multiple array index errors in the Stream Control Transmission Protocol (SCTP) module. Local users can gain privileges via the stream id to the setsockopt function when setting the SCTIP SS VALUE option. Alternatively, they can read arbitrary kernel memory via the stream id to the getsockopt function when getting the SCTP SS PRIORITY option.

Recommendations For FreeBSD version 8.4, update to p23 or later. For FreeBSD version 9.3, update to p9 or later. For FreeBSD version 10.0, update to p17 or later. For FreeBSD version 10.1, update to p5 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-8612

Produtos afetados

Freebsd

Referências · 8

• 🔥 https://exploit-db.com/exploits/35938 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jan/107 · Exploit
• 🔥 http://coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities · Exploit
• 🔥 http://securitytracker.com/id/1031648 · Exploit
• https://freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc · Aviso do Fabricante
• http://securityfocus.com/archive/1/534563/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8612 · Nota de Segurança
• http://securityfocus.com/bid/72342 · Nota