BID:34666

FreeBSD libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability

Info

FreeBSD libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability

Bugtraq ID:	34666
Class:	Design Error
CVE:	CVE-2009-1436
Remote:	No
Local:	Yes
Published:	Jan 15 2009 12:00AM
Updated:	Jul 14 2016 10:00PM
Credit:	Jaakko Heinonen and Xin LI
Vulnerable:	Juniper Junos 8.5 FreeBSD FreeBSD 7.1-STABLE FreeBSD FreeBSD 7.1-RELEASE-p4 FreeBSD FreeBSD 7.1 -RELEASE-p2 FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 7.1 FreeBSD FreeBSD 7.0-STABLE FreeBSD FreeBSD 7.0-RELEASE-p8 FreeBSD FreeBSD 7.0-RELEASE-p11 FreeBSD FreeBSD 7.0-RELEASE FreeBSD FreeBSD 7.0 BETA4 FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 -RELEASE-p9 FreeBSD FreeBSD 7.0 -PRERELEASE FreeBSD FreeBSD 7.0 FreeBSD FreeBSD 6.4-RELEASE-p2 FreeBSD FreeBSD 6.4 -RELEASE-p3 FreeBSD FreeBSD 6.4 -RELEASE FreeBSD FreeBSD 6.4 FreeBSD FreeBSD 6.3 -RELENG FreeBSD FreeBSD 6.3 -RELEASE-p9 FreeBSD FreeBSD 6.3 -RELEASE-p8 FreeBSD FreeBSD 6.3 -RELEASE-p6 FreeBSD FreeBSD 6.3

Not Vulnerable:	Juniper Junos 15.1X49-D20 Juniper Junos 15.1X49-D10 Juniper Junos 15.1R2 Juniper Junos 15.1F3 Juniper Junos 14.2R4 Juniper Junos 14.1X53-D30 Juniper Junos 14.1R6 Juniper Junos 13.3R7 Juniper Junos 13.2X52-D30 Juniper Junos 13.2X51-D40 Juniper Junos 13.2R8 Juniper Junos 12.3X50-D50 Juniper Junos 12.3X48-D20 Juniper Junos 12.3R11 Juniper Junos 12.1X47-D25 Juniper Junos 12.1X46-D40 Juniper Junos 12.1X44-D55 FreeBSD FreeBSD 7.2-PRERELEASE FreeBSD FreeBSD 7.1-RELEASE-p5 FreeBSD FreeBSD 7.0-RELEASE-p12 FreeBSD FreeBSD 6.4-RELEASE-p4 FreeBSD FreeBSD 6.4 -STABLE FreeBSD FreeBSD 6.3-RELEASE-p10

Discussion

FreeBSD libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability

FreeBSD is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Exploit / POC

FreeBSD libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability

An attacker may exploit this issue using readily available tools.

The following proof of concept is available:

/data/vulnerabilities/exploits/34666.c

Solution / Fix

FreeBSD libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

FreeBSD FreeBSD 7.0-RELEASE-p8