Vulnerability CVE-2005-0988


Published: 2005-05-02   Modified: 2012-02-12

Description:
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.

Vendor: Turbolinux
Product: Turbolinux server 
Version:
8.0
7.0
10.0
Product: Turbolinux workstation 
Version: 8.0; 7.0;
Product: Turbolinux desktop 
Version: 10.0;
Product: Turbolinux appliance server 
Version: 1.0_workgroup; 1.0_hosting;
Product: Turbolinux home 
Vendor: Freebsd
Product: Freebsd 
Version:
5.4
5.3
5.2.1
5.2
5.1
5.0
4.9
4.8
4.7
4.6.2
4.6
4.5
4.4
4.3
4.2
4.11
4.10
4.1.1
4.0
Vendor: Ubuntu
Product: Ubuntu linux 
Version: 5.04; 4.1;
Vendor: Redhat
Product: Enterprise linux 
Version:
4.0
3.0
2.1
Product: Enterprise linux desktop 
Version: 4.0; 3.0;
Product: Linux advanced workstation 
Version: 2.1;
Vendor: Trustix
Product: Secure linux 
Version:
2.2
2.1
2.0
Vendor: GNU
Product: GZIP 
Version:
1.3.3
1.2.4a
1.2.4
Vendor: Gentoo
Product: Linux 

CVSS2 => (AV:L/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.7/10
6.4/10
1.9/10
Exploit range
Attack complexity
Authentication
Local
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
http://rhn.redhat.com/errata/RHSA-2005-357.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101816-1
http://www.debian.org/security/2005/dsa-752
http://www.securityfocus.com/archive/1/394965
http://www.securityfocus.com/bid/12996
http://www.securityfocus.com/bid/19289
http://www.us-cert.gov/cas/techalerts/TA06-214A.html
http://www.vupen.com/english/advisories/2006/3101
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10242
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1169
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A765

Related CVE
CVE-2017-14483
flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file...
CVE-2017-14484
The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an unsafe "chown -R" command is executed.
CVE-2004-2778
Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or...
CVE-2014-9756
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
CVE-2014-9622
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
CVE-2014-9496
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
CVE-2013-2100
The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a craf...
CVE-2014-4909
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bo...

Copyright 2019, cxsecurity.com

 

Back to Top