The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Provos_systrace | Niels | 1.1 (including) | 1.1 (including) |
| Provos_systrace | Niels | 1.2 (including) | 1.2 (including) |
| Provos_systrace | Niels | 1.3 (including) | 1.3 (including) |
| Provos_systrace | Niels | 1.4 (including) | 1.4 (including) |
| Provos_systrace | Niels | 1.5 (including) | 1.5 (including) |
| Systrace_port_for_freebsd | Vladimir_kotal | 2004-03-09 (including) | 2004-03-09 (including) |
| Systrace_port_for_freebsd | Vladimir_kotal | 2004-06-02 (including) | 2004-06-02 (including) |
References
- ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-007.txt.asc
- http://marc.info/?l=bugtraq\u0026m=108432258920570\u0026w=2
- http://secunia.com/advisories/11585
- http://www.securityfocus.com/bid/10320
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16110
- ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-007.txt.asc
- http://marc.info/?l=bugtraq\u0026m=108432258920570\u0026w=2
- http://secunia.com/advisories/11585
- http://www.securityfocus.com/bid/10320
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16110