Secunia

Some vulnerabilities have been reported in FreeBSD, which can be exploited by malicious, local users to disclose sensitive information.

1) An error exists within the implementation of the "openpty()" function when setting permissions for opened pseudo terminals. This can be exploited by malicious, local users to read text from a pty opened by a non root user by executing a program which internally calls "openpty()" (e.g. "script").

The vulnerability affects FreeBSD 5.0 and later.

2) An error exists within the implementation of the "ptsname()" function. This can be exploited by malicious, local users to obtain the ownership of a normally restricted pty by executing pt_chown.

Successful exploitation requires that the attacker has read access on a device node with a name containing the name of the snooped pty.

The vulnerability affects FreeBSD 6.0 and later.

Solution
Update FreeBSD or apply patches.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits John Baldwin.

Original Advisory
http://security.freebsd.org/advisories/FreeBSD-SA-08:01.pty.asc

Deep Links
Links available in Customer Area