FreeBSD 'execl()' Local Privilege Escalation Vulnerability
BID:37154
Info
FreeBSD 'execl()' Local Privilege Escalation Vulnerability
| Bugtraq ID: | 37154 |
| Class: | Design Error |
| CVE: |
CVE-2009-4146 CVE-2009-4147 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 30 2009 12:00AM |
| Updated: | Mar 19 2015 09:18AM |
| Credit: | Nikolaos Rangos (Kingcope) |
| Vulnerable: |
FreeBSD FreeBSD 8.0-STABLE FreeBSD FreeBSD 8.0-RELEASE FreeBSD FreeBSD 7.2-STABLE FreeBSD FreeBSD 7.2-RELEASE-p4 FreeBSD FreeBSD 7.2-RELEASE-p1 FreeBSD FreeBSD 7.2-RC2 FreeBSD FreeBSD 7.2-PRERELEASE FreeBSD FreeBSD 7.1-STABLE FreeBSD FreeBSD 7.1-RELEASE-p6 FreeBSD FreeBSD 7.1-RELEASE-p5 FreeBSD FreeBSD 7.1-RELEASE-p4 FreeBSD FreeBSD 7.1 -RELEASE-p2 FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 7.0-STABLE FreeBSD FreeBSD 7.0-RELEASE-p8 FreeBSD FreeBSD 7.0-RELEASE-p3 FreeBSD FreeBSD 7.0-RELEASE-p12 FreeBSD FreeBSD 7.0-RELEASE-p11 FreeBSD FreeBSD 7.0-RELEASE FreeBSD FreeBSD 7.0 BETA4 FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 -RELEASE-p9 FreeBSD FreeBSD 7.0 -PRERELEASE FreeBSD FreeBSD 7.0 BSD Perimeter pfSense 1.2.2 BSD Perimeter pfSense 1.2.1 BSD Perimeter pfSense 1.2-RC4 BSD Perimeter pfSense 1.2-RC3 BSD Perimeter pfSense 1.2-RC2 BSD Perimeter pfSense 1.2-RC1 BSD Perimeter pfSense 1.2 |
| Not Vulnerable: |
BSD Perimeter pfSense 1.2.3 |
Discussion
FreeBSD 'execl()' Local Privilege Escalation Vulnerability
FreeBSD is prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with root privileges. Successful exploits will result in the complete compromise of affected computers.
FreeBSD 7.0-RELEASE through 8.0-RELEASE are vulnerable; other versions may also be affected.
FreeBSD is prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with root privileges. Successful exploits will result in the complete compromise of affected computers.
FreeBSD 7.0-RELEASE through 8.0-RELEASE are vulnerable; other versions may also be affected.
Exploit / POC
FreeBSD 'execl()' Local Privilege Escalation Vulnerability
The following exploits are available:
The following exploits are available:
Solution / Fix
FreeBSD 'execl()' Local Privilege Escalation Vulnerability
Solution:
The vendor released an advisory and patches to address this issue. Please see the references for details.
BSD Perimeter pfSense 1.2
BSD Perimeter pfSense 1.2-RC4
BSD Perimeter pfSense 1.2-RC3
BSD Perimeter pfSense 1.2-RC1
BSD Perimeter pfSense 1.2-RC2
BSD Perimeter pfSense 1.2
BSD Perimeter pfSense 1.2.1
BSD Perimeter pfSense 1.2.2
Solution:
The vendor released an advisory and patches to address this issue. Please see the references for details.
BSD Perimeter pfSense 1.2
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2-RC4
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2-RC3
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2-RC1
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2-RC2
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2.1
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
BSD Perimeter pfSense 1.2.2
-
BSD Perimeter pfSense-Full-Update-1.2.3-RELEASE.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.3-RELE ASE.tgz
References
FreeBSD 'execl()' Local Privilege Escalation Vulnerability
References:
References:
- ** FreeBSD local r00t zeroday (Kingcope)
- [FreeBSD-Announce] Upcoming FreeBSD Security Advisory (FreeBSD)
- 1.2.3 Release Available! (BSD Perimeter)
- Always check return value (Icke)
- FreeBSD Homepage (FreeBSD)
- FreeBSD LD_PRELOAD Security Bypass (xorl)
- rtld.c Patch (FreeBSD)
- ** FreeBSD local r00t zeroday (Kingcope
) - FreeBSD Security Advisory FreeBSD-SA-09:16.rtld (FreeBSD Security Advisories
) - Re: ** FreeBSD local r00t zeroday (Robert BARABAS
) - Upcoming FreeBSD Security Advisory (FreeBSD Security Officer
)