Vulnerabilities > CVE-2007-0166 - Local Symbolic Link vulnerability in FreeBSD Jail RC.D

CVSS 6.6 - MEDIUM

Attack vector

LOCAL

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

freebsd

NVD

Published: 2007-01-11

Updated: 2008-11-15

Summary

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.

Vulnerable Configurations

Part	Description	Count
OS	Freebsd Freebsd Freebsd 5.3 Freebsd Freebsd - Freebsd Freebsd 0.4_1 Freebsd Freebsd 1.0 Freebsd Freebsd 1.1 Freebsd Freebsd 1.1.5 Freebsd Freebsd 1.1.5.1 Freebsd Freebsd 1.2 Freebsd Freebsd 1.5 Freebsd Freebsd 2.0 Freebsd Freebsd 2.0.1 Freebsd Freebsd 2.0.5 Freebsd Freebsd 2.1 Freebsd Freebsd 2.1.0 Freebsd Freebsd 2.1.5 Freebsd Freebsd 2.1.6 Freebsd Freebsd 2.1.6.1 Freebsd Freebsd 2.1.7 Freebsd Freebsd 2.1.7.1 Freebsd Freebsd 2.2 Freebsd Freebsd 2.2.1 Freebsd Freebsd 2.2.2 Freebsd Freebsd 2.2.3 Freebsd Freebsd 2.2.4 Freebsd Freebsd 2.2.5 Freebsd Freebsd 2.2.6 Freebsd Freebsd 2.2.7 Freebsd Freebsd 2.2.8 Freebsd Freebsd 3.0 Freebsd Freebsd 3.1 Freebsd Freebsd 3.2 Freebsd Freebsd 3.3 Freebsd Freebsd 3.4 Freebsd Freebsd 3.5 Freebsd Freebsd 3.5.1 Freebsd Freebsd 4.0 Freebsd Freebsd 4.1 Freebsd Freebsd 4.1.1 Freebsd Freebsd 4.2 Freebsd Freebsd 4.3 Freebsd Freebsd 4.4 Freebsd Freebsd 4.5 Freebsd Freebsd 4.6 Freebsd Freebsd 4.6.1 Freebsd Freebsd 4.6.2 Freebsd Freebsd 4.7 Freebsd Freebsd 4.8 Freebsd Freebsd 4.9 Freebsd Freebsd 4.10 Freebsd Freebsd 4.11 Freebsd Freebsd 5.0 Freebsd Freebsd 5.1 Freebsd Freebsd 5.2 Freebsd Freebsd 5.2.1 Freebsd Freebsd 5.4 Freebsd Freebsd 5.5 Freebsd Freebsd 6.0 Freebsd Freebsd 6.1 Freebsd Freebsd 6.2	391

Summary

Vulnerable Configurations

References