A vulnerability has been reported in FreeBSD, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to the jail rc.d script not properly checking paths inside a jail file system structure before usage. This can be exploited via symlink attacks by the root user inside a jail to overwrite files outside the jail using /var/log/console.log or to mount or unmount file systems on the host system.

Successful exploitation allows execution of arbitrary commands with non-jailed superuser privileges.

NOTE: The vulnerability occurs only when a jail is being started or stopped using the host's jail rc.d script. Running jails cannot exploit this.

The vulnerability is reported in all FreeBSD releases since 5.3.

Solution
Update FreeBSD or apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Dirk Engling.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc

Deep Links
Links available to Secunia VIM customers