OpenBSD DEV/FD Arbitrary File Access Vulnerability

Bugtraq ID:	16144
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Jan 05 2006 12:00AM
Updated:	Jan 05 2006 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	OpenBSD OpenBSD 3.8 OpenBSD OpenBSD 3.7
Not Vulnerable:

OpenBSD DEV/FD Arbitrary File Access Vulnerability

OpenBSD is prone to a vulnerability that allows local attackers to gain access to arbitrary files.

This could allow attackers to obtain sensitive information, which may be used to carry out other attacks against a vulnerable computer.

This issue reportedly affects OpenBSD 3.7 and 3.8. Other versions may be vulnerable as well.

OpenBSD DEV/FD Arbitrary File Access Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBSD DEV/FD Arbitrary File Access Vulnerability

Solution:
The vendor has released patches to address this issue.


OpenBSD OpenBSD 3.7

• OpenBSD 008_fd.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch

OpenBSD OpenBSD 3.8

• OpenBSD 002_fd.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/002_fd.patch

OpenBSD DEV/FD Arbitrary File Access Vulnerability

References:

• OpenBSD Errata Page (OpenBSD)
  
• OpenBSD Homepage (OpenBSD)