CVE-2007-0166

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.

🔗 References (10)

• secteam@freebsdhttp://osvdb.org/32726
• secteam@freebsdhttp://secunia.com/advisories/23730
• secteam@freebsdhttp://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
• secteam@freebsdhttp://securitytracker.com/id?1017505
• secteam@freebsdhttp://www.securityfocus.com/bid/22011
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/32726
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23730
• af854a3a-2127-422b-91ae-364da2661108http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
• af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1017505
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/22011