FreeBSD : FreeBSD -- Inappropriate directory permissions in freebsd-update(8) (6e87b696-ca3e-11df-aade-0050568f000c)

High Nessus Plugin ID 50332


The remote FreeBSD host is missing one or more security-related updates.


When downloading updates to FreeBSD via 'freebsd-update fetch' or 'freebsd-update upgrade', the freebsd-update(8) utility copies currently installed files into its working directory (/var/db/freebsd-update by default) both for the purpose of merging changes to configuration files and in order to be able to roll back installed updates.

The default working directory used by freebsd-update(8) is normally created during the installation of FreeBSD with permissions which allow all local users to see its contents, and freebsd-update(8) does not take any steps to restrict access to files stored in said directory.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 50332

File Name: freebsd_pkg_6e87b696ca3e11dfaade0050568f000c.nasl

Version: $Revision: 1.7 $

Type: local

Published: 2010/10/26

Modified: 2016/08/10

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:FreeBSD, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info, Settings/ParanoidReport

Patch Publication Date: 2010/10/24

Vulnerability Publication Date: 2009/12/03

Reference Information

OSVDB: 61108

FreeBSD: SA-09:17.freebsd-update