FreeBSD Process Concealment Bypass Vulnerability

Bugtraq ID:	4768
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 18 2002 12:00AM
Updated:	May 18 2002 12:00AM
Credit:	This was discussed on February 3, 2002 on FreeBSD-bugs.
Vulnerable:	FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3
Not Vulnerable:

FreeBSD Process Concealment Bypass Vulnerability

In FreeBSD, setting kern.ps_showallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fails to protest system process information.

It is still possible to obtain a list of processes from a procfs filesystem, or from specifying certain options to the 'ps' command.

FreeBSD Process Concealment Bypass Vulnerability

An exploit is available:

• /data/vulnerabilities/exploits/hhp-sap_evade.pl
• /data/vulnerabilities/exploits/info.sh

FreeBSD Process Concealment Bypass Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FreeBSD Process Concealment Bypass Vulnerability

References:

• ps information leak in FreeBSD ("Cache" )
  
• Re: ps information leak in FreeBSD (Sean Kelly )