PT-2002-1622 · Freebsd · Freebsd

Published 2002-06-11 · Updated 2018-10-30 · CVE-2002-0572

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 4.5 and earlier

Description The issue allows local users to access restricted files by manipulating file descriptors. This is done by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which can then be reused by a setuid process. This process intended to perform input/output operations on normal files, but due to the file descriptor manipulation, it may end up accessing restricted files instead.

Recommendations For FreeBSD versions 4.5 and earlier, consider updating to a newer version to mitigate the risk, as the exact fix or patch details are not specified. As a temporary workaround, consider restricting the use of setuid processes or implementing additional access controls to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0572

Affected Products

Freebsd

References · 11

• 🔥 http://securityfocus.com/bid/4568 · Exploit
• 🔥 https://exploit-db.com/exploits/21407 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/268970 · Exploit
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0572 · Security Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0033.html · Note
• http://osvdb.org/6095 · Note
• http://kb.cert.org/vuls/id/809347 · Note
• http://online.securityfocus.com/archive/1/269102 · Note
• http://iss.net/security_center/static/8920.php · Note
• http://ciac.org/ciac/bulletins/m-072.shtml · Note