Vulnerability CVE-2006-6939


Published: 2007-01-16   Modified: 2011-03-07

Description:
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.

Vendor: GNU
Product: ED 
Version: 0.2;

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.6/10
6.4/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://xforce.iss.net/xforce/xfdb/30374
http://www.vupen.com/english/advisories/2006/4573
http://freshmeat.net/projects/ed/?branch_id=17855&release_id=240890
https://issues.rpath.com/browse/RPL-962
http://www.trustix.org/errata/2007/0005
http://www.securityfocus.com/bid/22129
http://www.mandriva.com/security/advisories?name=MDKSA-2007:023
http://secunia.com/advisories/24054
http://secunia.com/advisories/23857
http://secunia.com/advisories/23848
http://secunia.com/advisories/23832
http://fedoranews.org/cms/node/2450
http://fedoranews.org/cms/node/2449

Related CVE
CVE-2017-16830
The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possi...
CVE-2017-16831
coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or exce...
CVE-2017-16832
The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a d...
CVE-2017-16827
The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) ...
CVE-2017-16828
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted...
CVE-2017-16829
The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of ser...
CVE-2017-16826
The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or po...
CVE-2017-1000383
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs...

Copyright 2017, cxsecurity.com

 

Back to Top