Vulnerability CVE-2007-4305
Published: 2007-08-13   Modified: 2012-02-12

Description:
Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing.

CVSS2 => (AV:L/AC:H/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.2/10
10/10
1.9/10
Exploit range
Attack complexity
Authentication
Local
High
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Todd miller -> SUDO 
Systrace -> Systrace 
Sysjail -> Sysjail 

 References:
http://www.watson.org/~robert/2007woot/
http://www.securityfocus.com/bid/25258
http://secunia.com/advisories/26479
Copyright 2024, cxsecurity.com

 

Back to Top