PT-2023-6927 · Freebsd · Freebsd

Mariusz Zaborski + 1 · Publicado 2023-11-06 · Atualizado 2023-12-14 · CVE-2023-5978

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 13-RELEASE through 13-RELEASE-p4

Description The issue is related to errors in privilege management in the cap net service of the FreeBSD operating system. This could allow a remote attacker to modify the list of allowed domain names. Specifically, when only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including entries not previously listed, potentially permitting the application to resolve domain names that were previously restricted.

Recommendations For FreeBSD versions 13-RELEASE through 13-RELEASE-p4, update to version 13-RELEASE-p5 or later to resolve the issue. As a temporary workaround, consider restricting access to the cap net libcasper(3) service to minimize the risk of exploitation. Avoid submitting new lists of domains to the cap net service until the issue is resolved.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2023-07946

CVE-2023-5978

FREEBSD-SA-23_16

Produtos afetados

Freebsd

Referências · 9

• https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc · Aviso do Fabricante
• https://t.me/cvenotify/63676 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20231214-0003 · Nota
• https://bdu.fstec.ru/vul/2023-07946 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1722223080955887798 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5978 · Nota de Segurança
• https://twitter.com/CVEnew/status/1722180903277871214 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5978 · Aviso do Fabricante
• https://freebsd.org/security/advisories/FreeBSD-SA-23:16.cap_net.asc · Nota