多个供应商进BSD KTrace SUID/SGID进程追踪漏洞

漏洞信息详情

多个供应商进BSD KTrace SUID/SGID进程追踪漏洞

• CNNVD编号：CNNVD-200207-077
• 危害等级： 低危
  
  
• CVE编号：
  CVE-2002-0701
  
• 漏洞类型：
  
  
  设计错误
  
• 发布时间：
  
  2002-07-23
  
• 威胁类型：
  
  
  本地
  
• 更新时间：
  
  2005-05-02
  
• 厂        商：
  
  openbsd
• 漏洞来源：
  This issue was pub…

基于BSD的操作系统的ktrace存在漏洞。带有特权的进程所有者在特权被降低之后追踪进程，所有者可以在进程带额外特权运行时获得进程中的敏感信息。

OpenBSD has released source code patches which address this issue.
FreeBSD patches are available. Additionally, this vulnerability is fixed in recent versions of FreeBSD as follows:
2002-07-05 22:36:38 UTC (RELENG_4)
2002-07-11 16:47:41 UTC (RELENG_4_6)
2002-07-11 16:47:55 UTC (RELENG_4_5)
2002-07-11 16:56:05 UTC (RELENG_4_4)
OpenBSD OpenBSD 3.1

• OpenBSD 009_ktrace.patchSource code patch.
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/009_ktrace.patch

OpenBSD OpenBSD 3.0

• OpenBSD 026_ktrace.patchSource code patch.
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/026_ktrace.patch

FreeBSD FreeBSD 4.4

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.4 -STABLE

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.4 -RELENG

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.5 -STABLE

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.5

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.5 -RELEASE

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.6

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

FreeBSD FreeBSD 4.6 -RELEASE

• FreeBSD ktrace.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch
• FreeBSD ktrace.patch.asc
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:30/ktrace.patch.a
  sc

来源: FREEBSD
名称: FreeBSD-SA-02:30
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=102650797504351&w=2

来源: BID
名称: 5133
链接:http://www.securityfocus.com/bid/5133

来源: OPENBSD
名称: 20020627 009: SECURITY FIX: June 27, 2002
链接:http://www.openbsd.org/errata.html#ktrace

来源: XF
名称: openbsd-ktrace-gain-privileges(9474)
链接:http://www.iss.net/security_center/static/9474.php