Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2004-2012

Overview

Vulnerability Score 7.2 7.2
CVE Id CVE-2004-2012
Last Modified 05 Sep 2008 04:42:57
Published 31 Dec 2004 12:00:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector LOCAL
Access Complexity LOW
Authentication NONE

CVE-2004-2012

Summary

The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.

Vulnerable Systems

Operating System

  • Netbsd 2.0

Application

  • Niels Provos Systrace 1.1

  • Niels Provos Systrace 1.2

  • Niels Provos Systrace 1.3

  • Niels Provos Systrace 1.4

  • Niels Provos Systrace 1.5

  • Vladimir Kotal Systrace Port For Freebsd 2004-03-09

  • Vladimir Kotal Systrace Port For Freebsd 2004-06-02


References

XF - systrace-gain-privileges(16110)

BID - 10320

SECUNIA - 11585

BUGTRAQ - 20040510 Advisory 04/2004: Net(Free)BSD Systrace local root vulnerabilitiy


Last Updated: 27 May 2016 10:39:17