CVE-2015-5677

Published: Feb 7, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file.

Affected (3)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.1
Freebsd Freebsd	Version 10.2
Freebsd Freebsd	Version 9.3

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.securitytracker.com/id/1034678

Source: cve@mitre.org

https://pierrekim.github.io/blog/2016-01-15-cve-2015-5677-freebsd-bsnmpd.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.freebsd.org/security/advisories/FreeBSD-SA-16:06.bsnmpd.asc

Source: cve@mitre.org

PatchVendor Advisory

http://www.securitytracker.com/id/1034678

Source: af854a3a-2127-422b-91ae-364da2661108

https://pierrekim.github.io/blog/2016-01-15-cve-2015-5677-freebsd-bsnmpd.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.freebsd.org/security/advisories/FreeBSD-SA-16:06.bsnmpd.asc

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.