PT-2015-4055 · Freebsd · Freebsd

Published 2015-02-02 · Updated 2018-10-09 · CVE-2014-8612

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.4 before p23 FreeBSD versions 9.3 before p9 FreeBSD versions 10.0 before p17 FreeBSD versions 10.1 before p5

Description The issue concerns multiple array index errors in the Stream Control Transmission Protocol (SCTP) module. Local users can gain privileges via the stream id to the setsockopt function when setting the SCTIP SS VALUE option. Alternatively, they can read arbitrary kernel memory via the stream id to the getsockopt function when getting the SCTP SS PRIORITY option.

Recommendations For FreeBSD version 8.4, update to p23 or later. For FreeBSD version 9.3, update to p9 or later. For FreeBSD version 10.0, update to p17 or later. For FreeBSD version 10.1, update to p5 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8612

Affected Products

Freebsd

References · 8

• 🔥 https://exploit-db.com/exploits/35938 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jan/107 · Exploit
• 🔥 http://coresecurity.com/advisories/freebsd-kernel-multiple-vulnerabilities · Exploit
• 🔥 http://securitytracker.com/id/1031648 · Exploit
• https://freebsd.org/security/advisories/FreeBSD-SA-15:02.kmem.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8612 · Security Note
• http://securityfocus.com/archive/1/534563/100/0/threaded · Note
• http://securityfocus.com/bid/72342 · Note