| Vulnerability Name: | CVE-2010-2022 (CCN-58958) | ||||||||
| Assigned: | 2010-05-27 | ||||||||
| Published: | 2010-05-27 | ||||||||
| Updated: | 2010-06-01 | ||||||||
| Summary: | jail.c in jail in FreeBSD 8.0 and 8.1-PRERELEASE, when the "-l -U root" options are omitted, does not properly restrict access to the current working directory, which might allow local users to read, modify, or create arbitrary files via standard filesystem operations. | ||||||||
| CVSS v3 Severity: | 5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 3.3 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N) 2.5 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2010-2022 Source: CCN Type: FreeBSD-SA-10:04.jail Insufficient environment sanitization in jail(8) Source: FREEBSD Type: Vendor Advisory FreeBSD-SA-10:04 Source: CCN Type: SECTRACK ID: 1024038 FreeBSD jail() Lets Local Users Access Restricted Files Source: SECTRACK Type: UNKNOWN 1024038 Source: CCN Type: OSVDB ID: 65152 FreeBSD jail(8) Descendant Process CWD Escape Arbitrary File Access Source: BID Type: UNKNOWN 40399 Source: CCN Type: BID-40399 FreeBSD jail(8) Local Security Bypass Vulnerability Source: VUPEN Type: Patch, Vendor Advisory ADV-2010-1247 Source: XF Type: UNKNOWN freebsd-jail-security-bypass(58958) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||