CVSS: 7.2EPSS: 0%CPEs: 14EXPL: 1CVE-2010-2693 – FreeBSD - 'mbufs()' sendfile Cache Poisoning Privilege Escalation
https://notcve.org/view.php?id=CVE-2010-2693
FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service (system file corruption) and gain privileges via the sendfile system call. FreeBSD v7.1 a la v8.1-PRERELEASE no copia la bandera (flag) de solo lectura cuando crea una referencia duplicada del búfer mbuf, lo que permite a usuarios locales provocar una denegación de servicio (corrupción del sistema de ficheros) y la obtención de privilegios a través de una llamada al sistema sendfile. • https://www.exploit-db.com/exploits/14688 http://secunia.com/advisories/40567 http://security.freebsd.org/advisories/FreeBSD-SA-10:07.mbuf.asc http://www.securityfocus.com/bid/41577 http://www.securitytracker.com/id?1024182 http://www.vupen.com/english/advisories/2010/1787 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 4CVE-2010-2020 – FreeBSD - 'mountnfs()' Denial of Service
https://notcve.org/view.php?id=CVE-2010-2020
sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length of a certain fhsize parameter, which allows local users to gain privileges via a crafted mount request. sys/nfsclient/nfs_vfsops.c en el cliente NFS en el kernel en FreeBSD v7.2 hasta v8.1-PRERELEASE, cuando vfs.usermount está habilitado no valida la longitud de ciertos parámetros fhsize, lo que permite a usuarios locales obtener privilegios a través de una petición mount manipulada. • https://www.exploit-db.com/exploits/14003 https://www.exploit-db.com/exploits/14002 http://security.FreeBSD.org/advisories/FreeBSD-SA-10:06.nfsclient.asc http://securitytracker.com/id?1024039 http://www.exploit-db.com/exploits/14002 http://www.exploit-db.com/exploits/14003 • CWE-20: Improper Input Validation •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2022
https://notcve.org/view.php?id=CVE-2010-2022
jail.c in jail in FreeBSD 8.0 and 8.1-PRERELEASE, when the "-l -U root" options are omitted, does not properly restrict access to the current working directory, which might allow local users to read, modify, or create arbitrary files via standard filesystem operations. jail.c en jail en FreeBSD v8.0 y v8.1-PRERELEASE, cuando las opciones "-l -U root" son omitidas, no restringe adecuadamente el acceso al directorio de trabajo actual, lo que podría permitir a usuarios locales leer, modificar, o crear ficheros de su elección a través de operaciones filesystem. • http://security.FreeBSD.org/advisories/FreeBSD-SA-10:04.jail.asc http://securitytracker.com/id?1024038 http://www.securityfocus.com/bid/40399 http://www.vupen.com/english/advisories/2010/1247 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 84%CPEs: 44EXPL: 2CVE-2010-1938 – FreeBSD 8.0 - 'ftpd' (FreeBSD-SA-10:05) Off-By-One (PoC)
https://notcve.org/view.php?id=CVE-2010-1938
Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long username, as demonstrated by a long USER command to the FreeBSD 8.0 ftpd. Error Off-by-oneen en la función __opiereadrec en readrec.c en libopie en OPIE v2.4.1-test1 y anteriores, utilizada en FreeBSD v6.4 hasta v8.1-PRERELEASE y otras plataformas, permite a atacantes remotos provocar una denegación de servicio (caída del demonio) o posiblemente ejecutar código de su elección a través de un nombre de usuraio largo, como se ha demostrado mediante un comando USER largo en el ftpd FreeBSD v8.0. • https://www.exploit-db.com/exploits/12762 http://blog.pi3.com.pl/?p=111 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584932 http://secunia.com/advisories/39963 http://secunia.com/advisories/39966 http://secunia.com/advisories/45136 http://security.FreeBSD.org/advisories/FreeBSD-SA-10:05.opie.asc http://securityreason.com/achievement_securityalert/87 http://securityreason.com/securityalert/7450 http://securitytracker.com/id?1024040 http://securitytracker.com/id?1025709 http&# • CWE-189: Numeric Errors •
CVSS: 2.1EPSS: 0%CPEs: 15EXPL: 0CVE-2010-0119
https://notcve.org/view.php?id=CVE-2010-0119
Bournal before 1.4.1 on FreeBSD 8.0, when the -K option is used, places a ccrypt key on the command line, which allows local users to obtain sensitive information by listing the process and its arguments, related to "echoing." Bournal anterior a v1.4.1 sobre FreeBSD v8.0, cuando se usa la opción -K, coloca una clave ccrypt en la línea de comandos que permite a usuarios locales obtener información sensible listando el proceso y sus argumentos. Relacionado con "echoing". • http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036697.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036701.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036764.html http://secunia.com/advisories/38723 http://secunia.com/advisories/38814 http://secunia.com/secunia_research/2010-7 http://www.securityfocus.com/archive/1/509688/100/0/threaded http://www.securityfocus.com/bid/38352 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •