A vulnerability classified as problematic has been found in Surf (affected version unknown). Affected is an unknown functionality of the component Cookie Jahr. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

surf: cookie jar has read access from other local user

The bug was discovered 02/10/2012. The weakness was shared 11/19/2019. This vulnerability is traded as CVE-2012-0842 since 01/19/2012. The attack needs to be approached locally. The successful exploitation needs a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 57907 (FreeBSD : surf -- private information disclosure (039d057e-544e-11e1-9fb7-003067b2972c)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (57907).

Productinfo

Name

• Surf

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion