CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 0CVE-2010-0318
https://notcve.org/view.php?id=CVE-2010-0318
The replay functionality for ZFS Intent Log (ZIL) in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances after a system crash or power failure. La funcionalidad replay para ZFS Intent Log (ZIL) en FreeBSD versiones 7.1, 7.2 y 8.0, al crear archivos durante la reproducción de una transacción setattr, utiliza 7777 permisos en lugar de los permisos originales, lo que podría permitir a los usuarios locales leer o modificar archivos no autorizados en circunstancias oportunistas luego de un fallo del sistema o fallo eléctrico. • http://secunia.com/advisories/38124 http://security.FreeBSD.org/advisories/FreeBSD-SA-10:03.zfs.asc http://www.securityfocus.com/bid/37657 http://www.securitytracker.com/id?1023407 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 65%CPEs: 11EXPL: 3CVE-2009-4502 – Zabbix Agent - 'net.tcp.listen' Command Injection
https://notcve.org/view.php?id=CVE-2009-4502
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses. La función NET_TCP_LISTEN en net.c en Zabbix Agent versiones anteriores a v1.6.7, cuando se ejecuta en FreeBSD o Solaris, permite a atacantes remotos eludir la asignación de EnableRemoteCommands y ejecutar comandos de su elección mediante metacaracteres del interprete de comandos en el argumento de net.tcp.listen. NOTA: este ataque está limitado a ser realizado desde direcciones IP de confianza. • https://www.exploit-db.com/exploits/16918 https://www.exploit-db.com/exploits/10431 http://secunia.com/advisories/37740 http://www.securityfocus.com/archive/1/508439 http://www.vupen.com/english/advisories/2009/3514 https://support.zabbix.com/browse/ZBX-1032 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2009-4358
https://notcve.org/view.php?id=CVE-2009-4358
freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure permissions in its working directory (/var/db/freebsd-update by default), which allows local users to read copies of sensitive files after a (1) freebsd-update fetch (fetch) or (2) freebsd-update upgrade (upgrade) operation. FreeBSD-update en FreeBSD v8.0, v7.2, v7.1, v6.4, y v6.3 utiliza permisos inseguros en su directorio de trabajo (/var/db/Freebsd-update por defecto), lo que permite leer las copias de archivos confidenciales a usuarios locales después de una operacion de actualización (1) freebsd-update (fetch) o (2) freebsd-update (upgrade). • http://secunia.com/advisories/37575 http://security.freebsd.org/advisories/FreeBSD-SA-09:17.freebsd-update.asc http://www.securityfocus.com/bid/37190 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 2CVE-2009-4147 – FreeBSD 8.0 Run-Time Link-Editor (RTLD) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2009-4147
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146. La función _rtld en Run-Time Link-Editor (rtld) en libexec/rtld-elf/rtld.c en FreeBSD v7.1 y v8.0 no limpia las variables de entorno de (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH lo que permite a usuarios locales conseguir privilegios mediante la ejecución de un programa setuid o setguid con una variable modificada que contiene una ruta de búsqueda sin confianza que apunta a una libreria de un troyano con vectores diferentes que CVE-2009-4146. • https://www.exploit-db.com/exploits/10255 http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html http://people.freebsd.org/~cperciva/rtld.patch http://secunia.com/advisories/37517 http://www.securityfocus.com/archive/1/508142/100/0/threaded http://www.securityfocus.com/archive/1/508146/100/0/threaded http://www.securityfocus.com/bid/37154 http://www.securitytracker.com/id?1023250 https://seclists.org/fulldisclosure/2009/Nov/371 https://c-skills& • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 3CVE-2009-4146 – FreeBSD 8.0 Run-Time Link-Editor (RTLD) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2009-4146
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147. La función _rtld en el Run-Time Link-Editor (rtld) de libexec/rtld-elf/rtld.c de FreeBSD v7.1, v7.2 y v8.0, no limpia la variable de entorno LD_PRELOAD, esto permite a usuarios locales aumentar sus privilegios al ejecutar el programa setuid o setguid con la variable LD_PRELOAD modificada para que contenga una ruta de búsqueda no confiable que apunte a una biblioteca de un Troyano. Se trata de una vulnerabilidad diferente de CVE-2009-4147. • https://www.exploit-db.com/exploits/10255 http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html http://people.freebsd.org/~cperciva/rtld.patch http://secunia.com/advisories/37517 http://www.securityfocus.com/archive/1/508142/100/0/threaded http://www.securityfocus.com/archive/1/508146/100/0/threaded http://www.securityfocus.com/archive/1/508168/100/0/threaded http://www.securityfocus.com/bid/37154 http://www.securitytracker.com/id?1023250 https: • CWE-264: Permissions, Privileges, and Access Controls •