PT-2017-6881 · Freebsd · Freebsd

Pierre Kim · Published 2016-01-14 · Updated 2017-09-10 · CVE-2015-5677

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.3, 10.1, and 10.2

Description The issue concerns the bsnmpd daemon in FreeBSD, which uses world-readable permissions on the snmpd.config file. This allows local users to read the file and obtain the secret key for USM authentication.

Recommendations For FreeBSD versions 9.3, 10.1, and 10.2, consider changing the permissions of the snmpd.config file to prevent world-readable access. For FreeBSD versions 9.3, 10.1, and 10.2, restrict local user access to the snmpd.config file until a proper fix is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-5677

FREEBSD-SA-16_06

Affected Products

Freebsd

References · 5

• 🔥 https://pierrekim.github.io/blog/2016-01-15-cve-2015-5677-freebsd-bsnmpd.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-5677 · Security Note
• https://freebsd.org/security/advisories/FreeBSD-SA-16:06.bsnmpd.asc · Vendor Advisory
• http://securitytracker.com/id/1034678 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5677 · Note