cve-2025-0374
Vulnerability from cvelistv5
Published
2025-01-30 04:49
Modified
2025-02-07 17:02
Summary
When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally have restricted visibility, such as /etc/master.passwd. An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.
Impacted products
Vendor Product Version
FreeBSD FreeBSD Version: 14.2-RELEASE
Version: 14.1-RELEASE
Version: 13.4-RELEASE
Create a notification for this product.
Show details on NVD website


{
   containers: {
      adp: [
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 6.5,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "LOW",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2025-0374",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-05T15:41:16.838358Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-05T15:43:07.693Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-07T17:02:52.274Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250207-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               modules: [
                  "etcupdate",
               ],
               product: "FreeBSD",
               vendor: "FreeBSD",
               versions: [
                  {
                     lessThan: "p1",
                     status: "affected",
                     version: "14.2-RELEASE",
                     versionType: "release",
                  },
                  {
                     lessThan: "p7",
                     status: "affected",
                     version: "14.1-RELEASE",
                     versionType: "release",
                  },
                  {
                     lessThan: "p3",
                     status: "affected",
                     version: "13.4-RELEASE",
                     versionType: "release",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Christos Chatzaras",
            },
         ],
         datePublic: "2025-01-29T21:45:18.000Z",
         descriptions: [
            {
               lang: "en",
               value: "When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts.  This version does not preserve the mode of the input file, and is world-readable.  This applies to files that would normally have restricted visibility, such as /etc/master.passwd.\n\nAn unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts.  This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-732",
                     description: "CWE-732 Incorrect Permission Assignment for Critical Resource",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-30T04:49:07.687Z",
            orgId: "63664ac6-956c-4cba-a5d0-f46076e16109",
            shortName: "freebsd",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc",
            },
         ],
         title: "Unprivileged access to system files",
      },
   },
   cveMetadata: {
      assignerOrgId: "63664ac6-956c-4cba-a5d0-f46076e16109",
      assignerShortName: "freebsd",
      cveId: "CVE-2025-0374",
      datePublished: "2025-01-30T04:49:07.687Z",
      dateReserved: "2025-01-10T08:54:23.906Z",
      dateUpdated: "2025-02-07T17:02:52.274Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2025-0374\",\"sourceIdentifier\":\"secteam@freebsd.org\",\"published\":\"2025-01-30T05:15:10.527\",\"lastModified\":\"2025-02-07T17:15:30.903\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts.  This version does not preserve the mode of the input file, and is world-readable.  This applies to files that would normally have restricted visibility, such as /etc/master.passwd.\\n\\nAn unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts.  This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.\"},{\"lang\":\"es\",\"value\":\"Cuando etcupdate encuentra conflictos al fusionar archivos, guarda una versión que contiene marcadores de conflicto en /var/db/etcupdate/conflicts. Esta versión no conserva el modo del archivo de entrada y es legible por todo el mundo. Esto se aplica a archivos que normalmente tendrían visibilidad restringida, como /etc/master.passwd. Un usuario local sin privilegios puede leer contraseñas de usuario y raíz cifradas desde el archivo temporal master.passwd manipulado en /var/db/etcupdate/conflicts. Esto es posible solo cuando surgen conflictos dentro del archivo de contraseñas durante una actualización y el archivo desprotegido se elimina cuando se resuelven los conflictos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secteam@freebsd.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"references\":[{\"url\":\"https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc\",\"source\":\"secteam@freebsd.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250207-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.netapp.com/advisory/ntap-20250207-0007/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-02-07T17:02:52.274Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0374\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-05T15:41:16.838358Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-30T15:47:47.675Z\"}}], \"cna\": {\"title\": \"Unprivileged access to system files\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Christos Chatzaras\"}], \"affected\": [{\"vendor\": \"FreeBSD\", \"modules\": [\"etcupdate\"], \"product\": \"FreeBSD\", \"versions\": [{\"status\": \"affected\", \"version\": \"14.2-RELEASE\", \"lessThan\": \"p1\", \"versionType\": \"release\"}, {\"status\": \"affected\", \"version\": \"14.1-RELEASE\", \"lessThan\": \"p7\", \"versionType\": \"release\"}, {\"status\": \"affected\", \"version\": \"13.4-RELEASE\", \"lessThan\": \"p3\", \"versionType\": \"release\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2025-01-29T21:45:18.000Z\", \"references\": [{\"url\": \"https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts.  This version does not preserve the mode of the input file, and is world-readable.  This applies to files that would normally have restricted visibility, such as /etc/master.passwd.\\n\\nAn unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts.  This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"shortName\": \"freebsd\", \"dateUpdated\": \"2025-01-30T04:49:07.687Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2025-0374\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-07T17:02:52.274Z\", \"dateReserved\": \"2025-01-10T08:54:23.906Z\", \"assignerOrgId\": \"63664ac6-956c-4cba-a5d0-f46076e16109\", \"datePublished\": \"2025-01-30T04:49:07.687Z\", \"assignerShortName\": \"freebsd\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.