vendor:
FreeBSD
by:
Kingcope
7,2
CVSS
HIGH
Local Privilege Escalation
264
CWE
Product Name: FreeBSD
Affected Version From: FreeBSD 8.* and 7.* prior to 12Jul2010
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: o:freebsd:freebsd
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: i386 and amd64
2010
FreeBSD x86/x64 Sendfile Cache Local Root XPL v2
This exploit allows a local user to gain root privileges on a vulnerable FreeBSD system. The exploit works by tampering with the /bin/sh file to contain a shellcode which does 'chmod a+s /tmp/sh', 'chown root /tmp/sh' and 'execve /tmp/sh2'. The exploit then uses a network connection to send the modified /bin/sh file to the vulnerable system and executes it as root.
Mitigation:
Update to the latest version of FreeBSD and apply all security patches.
