PT-2004-2049 · Freebsd · Freebsd

Published 2004-12-05 · Updated 2017-07-11 · CVE-2004-1066

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 4.8 through 5.3

Description: The issue is related to the cmdline pseudofiles in procfs and linprocfs, which do not properly validate a process argument vector. This allows local users to cause a denial of service, resulting in a system panic, or to read portions of kernel memory.

Recommendations: For FreeBSD versions 4.8 through 5.3, consider restricting access to the procfs and linprocfs filesystems to minimize the risk of exploitation. As a temporary workaround, limit the use of the cmdline pseudofiles until a patch is available.

Fix

Related Identifiers

CVE-2004-1066

Affected Products

Freebsd

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2004-1066 · Security Note
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:17.procfs.asc · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18321 · Note