PT-2001-2287 · Freebsd+2 · Freebsd+2

Published 2001-08-17 · Updated 2008-09-10 · CVE-2001-1145

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 4.3 and earlier NetBSD versions prior to 1.5.2 OpenBSD versions 2.9 and earlier

Description The issue allows fts routines to be forced into a different directory than intended when the directory above the current directory is moved. This could cause scripts to perform dangerous actions on the wrong directories.

Recommendations For FreeBSD versions 4.3 and earlier, consider updating to a version later than 4.3 to resolve the issue. For NetBSD versions prior to 1.5.2, update to version 1.5.2 or later to fix the problem. For OpenBSD versions 2.9 and earlier, update to a version later than 2.9 to mitigate the risk.

Fix

Related Identifiers

CVE-2001-1145

Affected Products

Freebsd

Netbsd

Openbsd

References · 7

• http://archives.neohapsis.com/archives/netbsd/2001-q3/0204.html · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:40.fts.v1.1.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1145 · Security Note
• http://iss.net/security_center/static/8715.php · Note
• http://openbsd.org/errata28.html · Patch, Vendor Advisory
• http://osvdb.org/5466 · Note
• http://securityfocus.com/bid/3205 · Note