CVE Daily

CVE-2014-8476

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the bu...

Low CVSS 2.1

Overview

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.

CWE: CWE-200 Published: 2014-11-13T21:32:07.703
Risk analysis

This vulnerability is rated 🟢 LOW.

  • CVSS: 2.1 (LOW)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags