PT-2010-2109 · Freebsd · Freebsd

Pawel Jakub Dawidek · Published 2010-01-15 · Updated 2011-08-08 · CVE-2010-0318

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 7.1 through 8.0

Description The issue affects the replay functionality for ZFS Intent Log (ZIL) in FreeBSD. When creating files during replay of a setattr transaction after a system crash or power failure, the functionality uses 7777 permissions instead of the original permissions. This might allow local users to read or modify unauthorized files in certain circumstances.

Recommendations For versions 7.1 through 8.0, update to a version that includes a fix for this issue to ensure that original file permissions are used during ZIL replay.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0318

Affected Products

Freebsd

References · 5

• http://security.freebsd.org/advisories/FreeBSD-SA-10:03.zfs.asc · Vendor Advisory
• http://secunia.com/advisories/38124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0318 · Security Note
• http://securitytracker.com/id?1023407 · Note
• http://securityfocus.com/bid/37657 · Note