PT-2009-3939 · Freebsd+2 · Freebsd+2

Jaakko Heinonen + 1 · Published 2009-04-27 · Updated 2016-11-28 · CVE-2009-1436

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE

Description The issue is related to the db interface in libc, which does not properly initialize memory for Berkeley DB 1.85 database structures. This allows local users to obtain sensitive information by reading a database file.

Recommendations For FreeBSD versions 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE, consider updating to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-1436

Affected Products

Berkeley Db

Freebsd

Junos

References · 8

• 🔥 https://exploit-db.com/exploits/32946 · Exploit
• 🔥 http://securityfocus.com/bid/34666 · Exploit
• http://security.freebsd.org/advisories/FreeBSD-SA-09:07.libc.asc · Vendor Advisory
• http://secunia.com/advisories/34810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1436 · Security Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10756 · Note
• http://securitytracker.com/id?1022113 · Note
• http://osvdb.org/53918 · Note