Lucene search
HistoryMay 10, 2005 - 4:00 a.m.
CVE-2004-2012
cve-2004-2012
systrace
netbsd
freebsd
root privileges
euid vulnerability
local exploit
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
0.4%
The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
Affected configurations
Node
nielsprovos_systraceMatch1.1
ORnielsprovos_systraceMatch1.2
ORnielsprovos_systraceMatch1.3
ORnielsprovos_systraceMatch1.4
ORnielsprovos_systraceMatch1.5
ORvladimir_kotalsystrace_port_for_freebsdMatch2004-03-09
ORvladimir_kotalsystrace_port_for_freebsdMatch2004-06-02
Node
netbsdnetbsdMatch2.0
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
0.4%
Related for CVE-2004-2012