PT-2014-8549 · Freebsd · Freebsd

Published 2014-11-13 · Updated 2014-11-14 · CVE-2014-8476

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.4 through 10.1-RC4

Description The issue concerns the setlogin function, which fails to initialize a buffer used for storing the login name. This allows local users to access sensitive information from kernel memory by calling the getlogin function, which returns the entire buffer.

Recommendations For FreeBSD versions 8.4 through 10.1-RC4, consider restricting access to the setlogin function and getlogin function until a proper fix is applied. As a temporary workaround, avoid using the getlogin function to minimize the risk of sensitive information disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-8476

DSA-3070-1

Affected Products

Freebsd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-8476 · Security Note
• http://debian.org/security/2014/dsa-3070 · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc · Vendor Advisory
• http://secunia.com/advisories/62218 · Note
• http://secunia.com/advisories/61118 · Note