Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2019-15876
HistoryApr 28, 2020 - 8:15 p.m.

CVE-2019-15876

2020-04-2820:15:12
CWE-862
[email protected]
web.nvd.nist.gov
34
cve-2019-15876
freebsd
privilege escalation
network driver
passthrough commands
device firmware

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.

Affected configurations

NVD
Node
freebsdfreebsdMatch11.3-
OR
freebsdfreebsdMatch11.3p1
OR
freebsdfreebsdMatch11.3p2
OR
freebsdfreebsdMatch11.3p3
OR
freebsdfreebsdMatch11.3p4
OR
freebsdfreebsdMatch11.3p5
OR
freebsdfreebsdMatch11.3p6
OR
freebsdfreebsdMatch12.1-
OR
freebsdfreebsdMatch12.1p1
OR
freebsdfreebsdMatch12.1p2

CNA Affected

[
  {
    "product": "FreeBSD",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, 11.3-RELEASE before 11.3-RELEASE-p7"
      }
    ]
  }
]

Related

nvd 1
freebsd 1
nessus 1
prion 1
freebsd_advisory 1
cvelist 1
nvd
nvd
CVE-2019-15876
2020-04-28 20:15:12
freebsd
freebsd
FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking
2020-03-19 00:00:00
nessus
nessus
FreeBSD : FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking (3c10ccdf-6a09-11ea-92ab-00163e433440)
2020-03-20 00:00:00
prion
prion
Command injection
2020-04-28 20:15:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-20:05.if_oce_ioctl
2020-03-19 00:00:00
cvelist
cvelist
CVE-2019-15876
2020-04-28 19:11:39

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON
Related for CVE-2019-15876
nvd1freebsd1nessus1prion1freebsd_advisory1cvelist1