PT-2017-6881 · Freebsd · Freebsd

Pierre Kim · Publicado 2016-01-14 · Atualizado 2017-09-10 · CVE-2015-5677

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.3, 10.1, and 10.2

Description The issue concerns the bsnmpd daemon in FreeBSD, which uses world-readable permissions on the snmpd.config file. This allows local users to read the file and obtain the secret key for USM authentication.

Recommendations For FreeBSD versions 9.3, 10.1, and 10.2, consider changing the permissions of the snmpd.config file to prevent world-readable access. For FreeBSD versions 9.3, 10.1, and 10.2, restrict local user access to the snmpd.config file until a proper fix is applied.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-5677

FREEBSD-SA-16_06

Produtos afetados

Freebsd

Referências · 5

• 🔥 https://pierrekim.github.io/blog/2016-01-15-cve-2015-5677-freebsd-bsnmpd.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-5677 · Nota de Segurança
• http://securitytracker.com/id/1034678 · Nota
• https://freebsd.org/security/advisories/FreeBSD-SA-16:06.bsnmpd.asc · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5677 · Nota