Published: 13/07/2010 Updated: 14/07/2010

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

FreeBSD 7.1 up to and including 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service (system file corruption) and gain privileges via the sendfile system call.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd 7.1
freebsd freebsd 7.2
freebsd freebsd 7.3
freebsd freebsd 8.0
freebsd freebsd 8.1

/* freebsd x86/x64 sendfile cache local root xpl v2 by Kingcope 2010 -- should h4x any freebsd 8* and 7* prior to 12Jul2010 tampers /bin/sh to contain a shellcode which does ' chmod a+s /tmp/sh chown root /tmp/sh execve /tmp/sh2 ' how to use: terminal 1: $ cp /bin/sh /tmp/sh $ cp /bin/sh /tmp/sh2 $ gcc cachec -o cache term ...

CWE-264 http://www.securityfocus.com/bid/41577 http://security.freebsd.org/advisories/FreeBSD-SA-10:07.mbuf.asc http://www.vupen.com/english/advisories/2010/1787 http://www.securitytracker.com/id?1024182 http://secunia.com/advisories/40567 https://nvd.nist.gov https://www.exploit-db.com/exploits/14688/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2010-2693

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect