Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-2022

jail.c in jail in FreeBSD 8.0 and 8.1-PRERELEASE, when the "-l -U root" options are omitted, does not properly restrict access to the current working directory, which might allow local users to read, modify, or create arbitrary files via standard filesystem operations.

Published

2010-05-28T18:30:01.580

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.3 (LOW)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

3.4

Impact Score

4.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	freebsd	freebsd	8.0	Yes
Operating System	freebsd	freebsd	8.1-prerelease	Yes

References

http://security.FreeBSD.org/advisories/FreeBSD-SA-10:04.jail.asc Vendor Advisory ([email protected])
http://securitytracker.com/id?1024038 ([email protected])
http://www.securityfocus.com/bid/40399 ([email protected])
http://www.vupen.com/english/advisories/2010/1247 Patch, Vendor Advisory ([email protected])
http://security.FreeBSD.org/advisories/FreeBSD-SA-10:04.jail.asc Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1024038 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/40399 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/1247 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)