PT-2019-4441 · Freebsd · Freebsd

Peter Holm · Publicado 2019-02-05 · Atualizado 2020-08-24 · CVE-2019-5596

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 11.2-STABLE after r338618 through 12.0-RELEASE before 12.0-RELEASE-p3 FreeBSD 12.0-STABLE before r343781

Description The issue is related to a bug in the reference count implementation for UNIX domain sockets, potentially allowing a malicious local user to gain root privileges or escape from a jail. It is also described as a vulnerability related to insufficient access control, which can be exploited to elevate privileges.

Recommendations For FreeBSD 11.2-STABLE after r338618 through 12.0-RELEASE before 12.0-RELEASE-p3, update to 12.0-RELEASE-p3 or later to resolve the issue. For FreeBSD 12.0-STABLE before r343781, update to r343781 or later to resolve the issue. As a temporary workaround, consider restricting access to UNIX domain sockets to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2020-00199

CVE-2019-5596

FREEBSD-SA-19_02

Produtos afetados

Freebsd

Referências · 8

• 🔥 https://exploit-db.com/exploits/47829 · Exploit
• 🔥 https://exploit-db.com/exploits/47081 · Exploit
• https://t.me/defcon_news/34635 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-5596 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00199 · Nota de Segurança
• http://packetstormsecurity.com/files/155790/FreeBSD-fd-Privilege-Escalation.html · Nota
• https://security.freebsd.org/advisories/FreeBSD-SA-19:02.fd.asc · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5596 · Nota de Segurança