Vulnerability 117746 - CERT Civis.Net

Vulnerability Name:

CCN-117746

Published:

2016-10-05

Updated:

2016-10-05

Summary:

FreeBSD libarchive could allow a local attacker to launch a symlink attack. Temporary files are created insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite files located outside of the libarchive extraction directory and modify content of certain files with elevated privileges.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.5 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Consequences:

File Manipulation

References:

Source: CCN
Type: SECTRACK ID: 1036978
FreeBSD libarchive Symlink/Hardlink Processing Bug Lets Local Users Overwrite Files or Modify Directory Permissions to Gain Elevated Privileges

Source: XF
Type: UNKNOWN
freebsd-libarchive-symlink(117746)

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-16:31.libarchive
Multiple libarchive vulnerabilities

Vulnerable Configuration:

Configuration CCN 1:

cpe:/o:freebsd:freebsd:10.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:10.2:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:10.3:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:11.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK