CVE-2007-0166

Severity: medium (CVSS 6.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-11 · updated 2026-06-16

Description

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.

Affected products

FreeBSD: through 6.2; 5.3

References

http://osvdb.org/32726
http://secunia.com/advisories/23730
http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
http://securitytracker.com/id?1017505
http://www.securityfocus.com/bid/22011
http://osvdb.org/32726
http://secunia.com/advisories/23730
http://security.freebsd.org/advisories/FreeBSD-SA-07:01.jail.asc
http://securitytracker.com/id?1017505
http://www.securityfocus.com/bid/22011

Get alerted when CVE-2007-0166 or the next vulnerability affects your stack