Vulnerability CVE-2006-2654 - CERT Civis.Net

Vulnerability Name:

CVE-2006-2654 (CCN-26860)

Assigned:

2006-05-31

Published:

2006-05-31

Updated:

2017-07-20

Summary:

Directory traversal vulnerability in smbfs smbfs on FreeBSD 4.10 up to 6.1 allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences.
Note: this is similar to CVE-2006-1864, but this is a different implementation of smbfs, so it has a different CVE identifier.

CVSS v3 Severity:

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2006-2654

Source: CCN
Type: SA20390
FreeBSD SMBFS chroot Directory Traversal Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20390

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-06:16.smbfs
smbfs chroot escape

Source: FREEBSD
Type: Vendor Advisory
FreeBSD-SA-06:16

Source: CCN
Type: SECTRACK ID: 1016194
FreeBSD smbfs `..\` Input Validation Hole Lets Users Traverse the Directory

Source: SECTRACK
Type: UNKNOWN
1016194

Source: OSVDB
Type: UNKNOWN
25851

Source: CCN
Type: OSVDB ID: 25851
FreeBSD SMBFS Traversal chroot Bypass

Source: BID
Type: UNKNOWN
18202

Source: CCN
Type: BID-18202
FreeBSD SMBFS CHRoot Security Restriction Bypass Vulnerability

Source: XF
Type: UNKNOWN
freebsd-smbfs-directory-traversal(26860)

Source: XF
Type: UNKNOWN
freebsd-smbfs-directory-traversal(26860)

Vulnerable Configuration:

Configuration 1:

cpe:/o:freebsd:freebsd:5.0:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:alpha:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:release_p14:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:alpha:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:release_p1:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:release_p5:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.2:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.2.1:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.2.1:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.2.1:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.3:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.3:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.3:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.3:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.4:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.4:pre-release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.4:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.4:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.4:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:6.0:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:6.0:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:6.0:stable:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:freebsd:freebsd:*:*:*:*:*:*:*:*

Denotes that component is vulnerable