CVE-2014-8476: Infoleak
The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8476?
CVE-2014-8476 is considered a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2014-8476?
To fix CVE-2014-8476, update FreeBSD to a version where the setlogin function is properly secured and the buffer is initialized.
What versions of FreeBSD are affected by CVE-2014-8476?
CVE-2014-8476 affects FreeBSD versions 8.4 through 10.1-RC4.
What type of information can be leaked due to CVE-2014-8476?
CVE-2014-8476 allows local users to retrieve sensitive information from kernel memory, including data that is left in the uninitialized buffer.
Is CVE-2014-8476 a remote vulnerability?
No, CVE-2014-8476 is a local vulnerability that requires access to the system to exploit.