Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Systrace on NetBSD/FreeBSD can give users root access

CVE-2004-2012 · published 21 years ago
Summary

The systrace tool in NetBSD (current and 2.0 before April 16 2004) and certain FreeBSD ports does not check who is connecting to its control socket before changing the effective user ID to 0. This omission lets a local user who can reach the socket elevate their privileges to the system administrator level. Apply the provided patches or upgrade to a version where the check is added to stop the privilege escalation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
niels provos_systrace 1.1
1.2
1.3
1.4
1.5
cpe:2.3:a:niels:provos_systrace:1.1:*:*:*:*:*:*:*
vladimir_kotal systrace_port_for_freebsd 2004-03-09
2004-06-02
cpe:2.3:a:vladimir_kotal:systrace_port_for_freebsd:2004-03-09:*:*:*:*:*:*:*
netbsd netbsd 2.0
cpe:2.3:o:netbsd:netbsd:2.0:*:*:*:*:*:*:*
Original advisory text
The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before sett...
The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published31 Dec 2004
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-2012 · NVD
Track software like this
Free during beta