Summary
The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-08:01.pty.asc
Solution
Upgrade your system to the appropriate stable release or security branch dated after the correction date
https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-08:01.pty.asc
Insight
pt_chown is a setuid root support utility used by grantpt(3) to change ownership of a tty.
openpty(3) is a support function in libutil which is used to obtain a pseudo-terminal.
script(1) is a utility which makes a typescript of everything printed on a terminal.
Two issues exist in the FreeBSD pty handling.
If openpty(3) is called as non-root user the newly created pseudo-terminal is world readable and writeable. While this is documented to be the case, script(1) still uses openpty(3) and script(1) may be used by non-root users [CVE-2008-0217].
The ptsname(3) function incorrectly extracts two characters from the name of a device node in /dev without verifying that it's actually operating on a valid pty which the calling user owns. pt_chown uses the bad result from ptsname(3) to change ownership of a pty to the user calling pt_chown [CVE-2008-0216].
Severity
Classification
-
CVE CVE-2008-0216 -
CVSS Base Score: 2.1
AV:L/AC:L/Au:N/C:N/I:P/A:N
Related Vulnerabilities