PT-2010-3641 · Freebsd · Freebsd

Aaron D. Gifford · Published 2010-05-28 · Updated 2010-06-01 · CVE-2010-2022

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.0 through 8.1-PRERELEASE

Description The issue is related to the jail.c component in FreeBSD, where it fails to properly restrict access to the current working directory when specific options are omitted. This could potentially allow local users to perform unauthorized filesystem operations, such as reading, modifying, or creating arbitrary files.

Recommendations For FreeBSD versions 8.0 through 8.1-PRERELEASE, consider restricting access to the jail.c component until a proper fix is applied, by using the "-l -U root" options to ensure proper access control.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2022

Affected Products

Freebsd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-2022 · Security Note
• http://vupen.com/english/advisories/2010/1247 · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-10:04.jail.asc · Vendor Advisory
• http://securityfocus.com/bid/40399 · Note
• http://securitytracker.com/id?1024038 · Note