The jail_attach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesnt have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freebsd | Freebsd | 5.1 (including) | 5.1 (including) |
| Freebsd | Freebsd | 5.1-release (including) | 5.1-release (including) |
| Freebsd | Freebsd | 5.2 (including) | 5.2 (including) |
| Freebsd | Freebsd | 5.2.1-release (including) | 5.2.1-release (including) |