PT-2007-1650 · Freebsd · Freebsd

Published 2007-01-11 · Updated 2008-11-15 · CVE-2007-0166

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 5.3 through 6.2

Description The issue allows local root users to overwrite arbitrary files or mount/unmount files outside of the jail via a symlink attack. This occurs because the jail rc.d script does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted.

Recommendations For FreeBSD versions 5.3 through 6.2, as a temporary workaround, consider restricting write access to /var/log/console.log to prevent arbitrary file overwrites. Additionally, restrict the ability to mount or unmount file systems to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0166

Affected Products

Freebsd

References · 6

• 🔥 http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0166 · Security Note
• http://securityfocus.com/bid/22011 · Note
• http://securitytracker.com/id?1017505 · Note
• http://secunia.com/advisories/23730 · Note
• http://osvdb.org/32726 · Note