CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.2 | $0-$5k | 0.00 |
A vulnerability classified as problematic was found in FreeBSD up to 5.3 (Operating System). This vulnerability affects an unknown part of the component procfs/linprocfs. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect confidentiality, and availability.
The weakness was presented 12/02/2004 by Bryan Fulton and Ted Unangst with Coverity, Inc. (Website). The advisory is available at ftp.freebsd.org. This vulnerability was named CVE-2004-1066 since 11/29/2004. The attack needs to be done within the local network. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.
Upgrading to version 4-STABLE eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at ftp.FreeBSD.org. The best possible mitigation is suggested to be patching the affected component.
The vulnerability is also documented in the vulnerability database at X-Force (18321).
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.4VulDB Meta Temp Score: 5.2
VulDB Base Score: 5.4
VulDB Temp Score: 5.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Denial of serviceCWE: CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Partially
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 52659
OpenVAS Name: FreeBSD Security Advisory (FreeBSD-SA-04:17.procfs.asc)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Upgrade: FreeBSD 4-STABLE
Patch: ftp.FreeBSD.org
Timeline
11/29/2004 🔍12/02/2004 🔍
12/02/2004 🔍
12/02/2004 🔍
12/02/2004 🔍
12/02/2004 🔍
12/02/2004 🔍
01/10/2005 🔍
01/10/2005 🔍
06/04/2006 🔍
03/10/2021 🔍
Sources
Product: freebsd.orgAdvisory: ftp.freebsd.org
Researcher: Bryan Fulton, Ted Unangst
Organization: Coverity, Inc.
Status: Confirmed
CVE: CVE-2004-1066 (🔍)
X-Force: 18321
SecurityTracker: 1012374
Vulnerability Center: 11743 - FreeBSD 4.0 - 5.3 procfs and linprocfs Local Denial of Service and Memory Read, Medium
SecurityFocus: 11789 - FreeBSD Linux ProcFS Local Kernel Denial Of Service And Information Disclosure Vulnerability
Secunia: 13352 - FreeBSD procfs/linprocfs Process Argument Vector Handling Vulnerability, Less Critical
OSVDB: 20288 - FreeBSD linprocfs cmdline Process Argument Vector Local DoS
Entry
Created: 12/02/2004 17:40Updated: 03/10/2021 11:12
Changes: 12/02/2004 17:40 (82), 06/30/2019 12:05 (1), 03/10/2021 11:12 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.