A vulnerability has been reported in FreeBSD, which can be exploited by malicious, local users to gain escalated privileges or by malicious users to bypass certain security restrictions.

The vulnerability is caused due to the use of the "getlogin()" function by opiepasswd to identify the user it is running as. In certain cases, "getlogin()" may identify the user as "root" even when it is being run by an unprivileged user. This can exploited by an unprivileged user to configure OPIE authentication for the root user.

Note: The vulnerability can potentially be exploited remotely if the system is configured with a CGI script that calls opiepasswd.

The vulnerability has been reported in all FreeBSD versions.

Solution
Update FreeBSD or apply patch.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Mykola Zubach.

Original Advisory
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.asc

Deep Links
Links available in Customer Area