← Back

CVE-2004-2012

nvd nist
Published: Dec 31, 2004Modified: Apr 16, 2026

JSON object

Loading...
7.2
Vector
AV:L/AC:L/Au:N/C:C/I:C/A:C
Exploitability: 3.9 / Impact: 10.0
Source: NVD

Description

The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.

Affected (8)

Niels
1 product
Provos Systrace
Vladimir Kotal
1 product
Systrace Port For Freebsd
Netbsd
1 product
Netbsd
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Niels
Provos Systrace
Version 1.1
Provos Systrace
Version 1.2
Provos Systrace
Version 1.3
Provos Systrace
Version 1.4
Provos Systrace
Version 1.5
Vladimir Kotal
Systrace Port For Freebsd
Version 2004-03-09
Systrace Port For Freebsd
Version 2004-06-02
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Netbsd
Version 2.0

References (10)

ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-007.txt.asc (unsafe URL)
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Exploit
Source: cve@mitre.org
ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-007.txt.asc (unsafe URL)
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.