PT-2025-3859 · Etcupdate+1 · Etcupdate+1

Christos Chatzaras · Published 2025-01-29 · Updated 2025-01-30 · CVE-2025-0374

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions etcupdate (affected versions not specified)

Description When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file and is world-readable, applying to files that would normally have restricted visibility, such as /etc/master.passwd. An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-13371

CVE-2025-0374

FREEBSD-SA-25_03

Affected Products

Freebsd

Etcupdate

References · 8

• https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0374 · Security Note
• https://bdu.fstec.ru/vul/2025-13371 · Security Note
• https://t.me/cvenotify/109117 · Telegram Post
• https://twitter.com/CVEnew/status/1884832697920717155 · Twitter Post
• https://security.netapp.com/advisory/ntap-20250207-0007 · Note
• https://t.me/cvedetector/16741 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-25:03.etcupdate.asc · Note