medium6.9Public exploit code
CVE-2010-2020
sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length o…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FreeBSD - 'mountnfs()' Denial of Service2010-06-23 · dos · freebsd · Verified
- FreeBSD 8.0/7.3/7.2 - 'nfs_mount()' Local Privilege Escalation2010-06-23 · local · freebsd · Verified
Impact
sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length of a certain fhsize parameter, which allows local users to gain privileges via a crafted mount request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freebsd | Freebsd | Versions 7.2, 8.0, 8.1-prerelease |
Weakness classification
References
- NVD record
- CVE.org record
- http://security.FreeBSD.org/advisories/FreeBSD-SA-10:06.nfsclient.asc
- http://securitytracker.com/id?1024039
- http://www.exploit-db.com/exploits/14002
- http://www.exploit-db.com/exploits/14003
- http://security.FreeBSD.org/advisories/FreeBSD-SA-10:06.nfsclient.asc
- http://securitytracker.com/id?1024039
- http://www.exploit-db.com/exploits/14002
- http://www.exploit-db.com/exploits/14003