CVE-2015-1415
Last modified
CVE-2015-1415 is a vulnerability of currently unknown severity. The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Freebsd | Freebsd | <= 10.1 | — |
| Freebsd | Freebsd | 10.0 | — |
| Freebsd | Freebsd | 10.1 | Rc1 |
References
- https://www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.ascExploit, Vendor Advisory
- https://www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.ascExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-1415?
How severe is CVE-2015-1415?
How do I fix CVE-2015-1415?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-1401Improper Authentication vulnerability in the "LDAP / SSO Aut…
- CVE-2015-1402Cross-site scripting (XSS) vulnerability in the Content Rati…
- CVE-2015-1403SQL injection vulnerability in the Content Rating extension …
- CVE-2015-1404Cross-site scripting (XSS) vulnerability in the Content Rati…
- CVE-2015-1405SQL injection vulnerability in the Content Rating Extbase ex…
- CVE-2015-1414Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p…
- CVE-2015-1416Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC…
- CVE-2015-1417The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.…
- CVE-2015-1418The do_ed_script function in pch.c in GNU patch through 2.7.…
- CVE-2015-1419Unspecified vulnerability in vsftpd 3.0.2 and earlier allows…
- CVE-2015-1420Race condition in the handle_to_path function in fs/fhandle.…
- CVE-2015-1421Use-after-free vulnerability in the sctp_assoc_update functi…
Are you affected by CVE-2015-1415?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST