PT-2004-1299 · Freebsd · Freebsd

Published 2004-03-03 · Updated 2017-10-10 · CVE-2004-0099

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 5.1 through 5.2

Description The issue concerns the mksnap ffs function in FreeBSD, which only sets the snapshot flag when creating a snapshot for a file system. This causes default values for other flags to be used, possibly disabling security-critical settings. As a result, a local user may be able to bypass intended access restrictions.

Recommendations For FreeBSD versions 5.1 through 5.2, consider manually configuring the necessary flags to ensure security-critical settings are enabled, as the default values may not provide the intended level of security.

Fix

Related Identifiers

CVE-2004-0099

Affected Products

Freebsd

References · 5

• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:01.mksnap_ffs.asc · Vendor Advisory
• http://securityfocus.com/bid/9533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0099 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15005 · Note
• http://osvdb.org/3790 · Note