Security readout for executives and security teams
Plain-English summary
CVE-2000-0915 is an old FreeBSD fingerd issue where a remote user could request a file name instead of a username and read arbitrary files. It matters mainly for legacy FreeBSD 4.1.1 systems with fingerd exposed. There is no cited evidence of active exploitation in the provided sources.
Executive priority
Treat as a legacy exposure cleanup item unless FreeBSD 4.1.1 with fingerd is still present. If present and reachable, prioritize isolation or remediation because arbitrary file read can expose sensitive configuration or user data.
Technical view
The CVE record describes an arbitrary file read flaw in fingerd on FreeBSD 4.1.1. The vulnerable behavior accepts a target file name where a normal username is expected. CVSS, CWE, affected CPEs, and detailed vendor remediation data are not provided in the source bundle.
Likely exposure
Exposure is likely limited to legacy FreeBSD 4.1.1 systems running fingerd, especially if reachable over untrusted networks. Modern systems are not identified as affected by the provided sources.
Exploitation context
The source describes remote arbitrary file read, but provides no exploit maturity details. CISA KEV is false in the bundle, so active exploitation should not be assumed from these sources.
Researcher notes
Evidence is sparse: the CVE description and IBM X-Force reference identify FreeBSD 4.1.1 fingerd arbitrary file read. No CVSS, CWE, patch reference, or KEV listing is present in the provided bundle. Avoid expanding affected scope beyond FreeBSD 4.1.1.
Mitigation direction
- Identify any FreeBSD 4.1.1 systems in the environment.
- Determine whether fingerd is installed, enabled, or network-reachable.
- Check FreeBSD or trusted vendor guidance for historical fixes or supported upgrade paths.
- Remove unnecessary exposure of fingerd from untrusted networks where operationally feasible.
- Prioritize retirement or isolation of unsupported legacy systems.
Validation and detection
- Confirm operating system version on legacy BSD assets.
- Verify whether fingerd is enabled on identified systems.
- Check network reachability to fingerd from untrusted segments.
- Review historical logs for unusual fingerd requests involving file-like names.
- Document compensating controls for any system that cannot be upgraded.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2000-0915 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- freebsd-fingerd-files(5385)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.