7.5

CVE-2013-3266

The nfsrvd_readdir function in sys/fs/nfsserver/nfs_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify that a READDIR request is for a directory node, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by specifying a plain file instead of a directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version 8.0
Freebsd ≫ Freebsd Version 8.1
Freebsd ≫ Freebsd Version 8.2
Freebsd ≫ Freebsd Version 8.3
Freebsd ≫ Freebsd Version 9.0
Freebsd ≫ Freebsd Version 9.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.51% 0.877
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/53241
http://www.debian.org/security/2013/dsa-2672
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:05.nfsserver.asc
Patch
Vendor Advisory
http://www.securitytracker.com/id/1028491