FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (f0683976-5779-11ea-8a77-1c872ccb1e42)

critical Nessus Plugin ID 133973

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

OpenSMTPD developers reports :

An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the _smtpq group.

An unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem).

Solution

Update the affected package.

Plugin Details

Severity: Critical

ID: 133973

File Name: freebsd_pkg_f0683976577911ea8a771c872ccb1e42.nasl

Version: 1.4

Type: local

Family: FreeBSD Local Security Checks

Published: 2/25/2020

Updated: 3/6/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-8794

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:opensmtpd, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/24/2020

Vulnerability Publication Date: 2/22/2020

Exploitable With

Metasploit (OpenSMTPD OOB Read Local Privilege Escalation)

Reference Information

CVE: CVE-2020-8793, CVE-2020-8794

Detections

Analytics