PT-2023-6927 · Freebsd · Freebsd

Mariusz Zaborski + 1 · Published 2023-11-06 · Updated 2023-12-14 · CVE-2023-5978

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 13-RELEASE through 13-RELEASE-p4

Description The issue is related to errors in privilege management in the cap net service of the FreeBSD operating system. This could allow a remote attacker to modify the list of allowed domain names. Specifically, when only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including entries not previously listed, potentially permitting the application to resolve domain names that were previously restricted.

Recommendations For FreeBSD versions 13-RELEASE through 13-RELEASE-p4, update to version 13-RELEASE-p5 or later to resolve the issue. As a temporary workaround, consider restricting access to the cap net libcasper(3) service to minimize the risk of exploitation. Avoid submitting new lists of domains to the cap net service until the issue is resolved.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-07946

CVE-2023-5978

FREEBSD-SA-23_16

Affected Products

Freebsd

References · 9

• https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07946 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5978 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5978 · Vendor Advisory
• https://t.me/cvenotify/63676 · Telegram Post
• https://security.netapp.com/advisory/ntap-20231214-0003 · Note
• https://twitter.com/VulmonFeeds/status/1722223080955887798 · Twitter Post
• https://twitter.com/CVEnew/status/1722180903277871214 · Twitter Post
• https://freebsd.org/security/advisories/FreeBSD-SA-23:16.cap_net.asc · Note