PT-2001-2166 · Freebsd · Freebsd

Published 2001-09-04 · Updated 2017-10-10 · CVE-2001-1017

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 4.2 through 4.3

Description The issue allows local users to potentially gain privileges by reading a copied file while it is being updated. This could enable them to obtain password hashes and crack the passwords.

Recommendations For versions 4.2 through 4.3, update the rmuser utility to ensure it does not create world-readable copies of the master.passwd file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1017

Affected Products

Freebsd

References · 5

• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:59.rmuser.v1.1.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1017 · Security Note
• http://securityfocus.com/bid/3282 · Vendor Advisory
• http://osvdb.org/1947 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7086 · Note