FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
BID:10485
Info
FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
| Bugtraq ID: | 10485 |
| Class: | Access Validation Error |
| CVE: |
CVE-2004-0125 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 07 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | Pawel Malachowski was credited for this vulnerability. |
| Vulnerable: |
FreeBSD FreeBSD 4.9 -RELENG FreeBSD FreeBSD 4.9 -PRERELEASE FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 -RELENG FreeBSD FreeBSD 4.8 -RELEASE-p7 FreeBSD FreeBSD 4.8 -PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 -STABLE FreeBSD FreeBSD 4.7 -RELENG FreeBSD FreeBSD 4.7 -RELEASE-p17 FreeBSD FreeBSD 4.7 -RELEASE FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6.2 FreeBSD FreeBSD 4.6 -STABLE FreeBSD FreeBSD 4.6 -RELENG FreeBSD FreeBSD 4.6 -RELEASE-p20 FreeBSD FreeBSD 4.6 -RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07 FreeBSD FreeBSD 4.5 -STABLE FreeBSD FreeBSD 4.5 -RELENG FreeBSD FreeBSD 4.5 -RELEASE-p32 FreeBSD FreeBSD 4.5 -RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 -STABLE FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 -RELEASE-p42 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELENG FreeBSD FreeBSD 4.3 -RELEASE-p38 FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 -STABLEpre122300 FreeBSD FreeBSD 4.2 -STABLEpre050201 FreeBSD FreeBSD 4.2 -STABLE FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.2 FreeBSD FreeBSD 4.1.1 -STABLE FreeBSD FreeBSD 4.1.1 -RELEASE FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0 .x FreeBSD FreeBSD 4.0 -RELENG FreeBSD FreeBSD 4.0 alpha FreeBSD FreeBSD 4.0 FreeBSD FreeBSD 4.10-PRERELEASE |
| Not Vulnerable: |
FreeBSD FreeBSD 4.10 -RELEASE |
Discussion
FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
FreeBSD improperly allows routing updates from superuser processes inside jail() environments.
An attacker that gains superuser privileges inside of a jailed process can send routing table changes. An attacker could corrupt the routing table of the server, denying network services to legitimate users. Attackers may also be able to perform connection-hijacking and redirection attacks, such as the SSH man-in-the-middle attack.
FreeBSD improperly allows routing updates from superuser processes inside jail() environments.
An attacker that gains superuser privileges inside of a jailed process can send routing table changes. An attacker could corrupt the routing table of the server, denying network services to legitimate users. Attackers may also be able to perform connection-hijacking and redirection attacks, such as the SSH man-in-the-middle attack.
Exploit / POC
FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
Solution:
FreeBSD has released advisory FreeBSD-SA-04:12 addressing this issue. Please see the referenced advisory for further information on patches and fixes.
FreeBSD FreeBSD 4.10-PRERELEASE
FreeBSD FreeBSD 4.0
FreeBSD FreeBSD 4.0 .x
FreeBSD FreeBSD 4.0 -RELENG
FreeBSD FreeBSD 4.0 alpha
FreeBSD FreeBSD 4.1
FreeBSD FreeBSD 4.1.1 -RELEASE
FreeBSD FreeBSD 4.1.1 -STABLE
FreeBSD FreeBSD 4.1.1
FreeBSD FreeBSD 4.2
FreeBSD FreeBSD 4.2 -RELEASE
FreeBSD FreeBSD 4.2 -STABLEpre122300
FreeBSD FreeBSD 4.2 -STABLEpre050201
FreeBSD FreeBSD 4.2 -STABLE
FreeBSD FreeBSD 4.3 -RELEASE-p38
FreeBSD FreeBSD 4.3 -STABLE
FreeBSD FreeBSD 4.3
FreeBSD FreeBSD 4.3 -RELEASE
FreeBSD FreeBSD 4.3 -RELENG
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.4 -RELENG
FreeBSD FreeBSD 4.4 -STABLE
FreeBSD FreeBSD 4.4 -RELEASE-p42
FreeBSD FreeBSD 4.4 -RELENG
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07
FreeBSD FreeBSD 4.5 -STABLE
FreeBSD FreeBSD 4.5 -RELEASE-p32
FreeBSD FreeBSD 4.5 -RELEASE
FreeBSD FreeBSD 4.5 -RELENG
FreeBSD FreeBSD 4.6 -RELEASE
FreeBSD FreeBSD 4.6 -RELEASE-p20
FreeBSD FreeBSD 4.6 -STABLE
FreeBSD FreeBSD 4.6 -RELENG
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.6.2
FreeBSD FreeBSD 4.7 -RELEASE-p17
FreeBSD FreeBSD 4.7 -RELENG
FreeBSD FreeBSD 4.7 -RELEASE
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.7 -STABLE
FreeBSD FreeBSD 4.8 -RELENG
FreeBSD FreeBSD 4.8 -PRERELEASE
FreeBSD FreeBSD 4.8 -RELEASE-p7
FreeBSD FreeBSD 4.8
FreeBSD FreeBSD 4.9
FreeBSD FreeBSD 4.9 -RELENG
FreeBSD FreeBSD 4.9 -PRERELEASE
Solution:
FreeBSD has released advisory FreeBSD-SA-04:12 addressing this issue. Please see the referenced advisory for further information on patches and fixes.
FreeBSD FreeBSD 4.10-PRERELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.0
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.0 .x
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.0 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.0 alpha
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.1
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.1.1 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.1.1 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.1.1
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.2
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.2 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.2 -STABLEpre122300
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.2 -STABLEpre050201
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.2 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.3 -RELEASE-p38
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.3 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.3
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.3 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.3 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.4
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.4 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.4 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.4 -RELEASE-p42
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.4 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5 -RELEASE-p32
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.5 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6 -RELEASE-p20
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.6.2
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.7 -RELEASE-p17
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.7 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.7 -RELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.7
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.7 -STABLE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.8 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.8 -PRERELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.8 -RELEASE-p7
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.8
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.9
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.9 -RELENG
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
FreeBSD FreeBSD 4.9 -PRERELEASE
-
FreeBSD jailroute.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patc h
References
FreeBSD jail() Process Unauthorized Routing Table Modification Vulnerability
References:
References:
- FreeBSD Homepage (FreeBSD)
- FreeBSD Security Information (FreeBSD)