CVE-2005-2960 cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
LowCVSS 2.1
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU cfengine | = 1.5 | No fix listed |
| GNU cfengine | = 1.5.3-4 | No fix listed |
| GNU cfengine | = 1.6-a10 | No fix listed |
| GNU cfengine | = 1.6-a11 | No fix listed |
| GNU cfengine | = 1.6.5 | No fix listed |
| GNU cfengine | = 2.0.0 | No fix listed |
| GNU cfengine | = 2.0.1 | No fix listed |
| GNU cfengine | = 2.0.2 | No fix listed |
| GNU cfengine | = 2.0.3 | No fix listed |
| GNU cfengine | = 2.0.4 | No fix listed |
| GNU cfengine | = 2.0.5 | No fix listed |
| GNU cfengine | = 2.0.5-b1 | No fix listed |
| GNU cfengine | = 2.0.5-pre | No fix listed |
| GNU cfengine | = 2.0.5-pre2 | No fix listed |
| GNU cfengine | = 2.0.6 | No fix listed |
| GNU cfengine | = 2.0.7 | No fix listed |
| GNU cfengine | = 2.0.7-p1 | No fix listed |
| GNU cfengine | = 2.0.7-p2 | No fix listed |
| GNU cfengine | = 2.0.7-p3 | No fix listed |
| GNU cfengine | = 2.0.8 | No fix listed |
| GNU cfengine | = 2.0.8-p1 | No fix listed |
| GNU cfengine | = 2.1.0-a6 | No fix listed |
| GNU cfengine | = 2.1.0-a8 | No fix listed |
| GNU cfengine | = 2.1.0-a9 | No fix listed |
| GNU cfengine | = 2.1.7-p1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU cfengine | = 2.1.8 | No fix listed |
| GNU cfengine | = 2.1.9 | No fix listed |
| GNU cfengine | = 2.1.16 | No fix listed |
| debian linux | = 3.1 | No fix listed |
References
- bugs.gentoo.org vendor-advisory
- groups.google.com patch vendor-advisory
- 17037 third-party-advisory vendor-advisory
- 17038 third-party-advisory
- 17040 third-party-advisory
- 17142 third-party-advisory
- 17182 third-party-advisory
- 17215 third-party-advisory
- DSA-835 patch vendor-advisory
- DSA-836 patch vendor-advisory
- MDKSA-2005:184 vendor-advisory
- SUSE-SR:2005:023 vendor-advisory
- 14994 vdb-entry
- USN-198-1 vendor-advisory
- cfengine-mulitple-file-symlink(22489) vdb-entry