Summary
The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:17.procfs.asc
Solution
Upgrade your system to the appropriate stable release or security branch dated after the correction date
https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-04:17.procfs.asc
Insight
The process file system, procfs(5), implements a view of the system process table inside the file system. It is normally mounted on /proc, and is required for the complete operation of programs such as ps(1) and w(1).
The Linux process file system, linprocfs(5), emulates a subset of Linux's process file system and is required for the complete operation of some Linux binaries.
The implementation of the /proc/curproc/cmdline pseudofile in the procfs(5) file system on FreeBSD 4.x and 5.x, and of the /proc/self/cmdline pseudofile in the linprocfs(5) file system on FreeBSD 5.x reads a process' argument vector from the process address space. During this operation, a pointer was dereferenced directly without the necessary validation steps being performed.
Severity
Classification
-
CVE CVE-2004-1066 -
CVSS Base Score: 3.6
AV:L/AC:L/Au:N/C:P/I:N/A:P
Related Vulnerabilities