PT-2005-1007 · Sympa · Sympa

Erik Sjölund · Publicado 2005-02-11 · Atualizado 2008-09-05 · CVE-2005-0073

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sympa version 3.3.3

Description The issue is related to a buffer overflow in the queue.c file of a support script for sympa. This can allow local users to execute arbitrary code when the script is run with setuid privileges. Additionally, there are multiple vulnerabilities in the wwsympa package that can lead to breaches of confidentiality, integrity, and availability of protected information, potentially exploitable by local attackers.

Recommendations For sympa version 3.3.3, consider restricting the execution of the support script or removing setuid privileges as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-01967

CVE-2005-0073

DSA-677-1

Produtos afetados

Sympa

Referências · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0073 · Nota de Segurança
• http://secunia.com/advisories/14224 · Nota
• https://osv.dev/vulnerability/CVE-2005-0073 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-0073 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0073 · Aviso do Fabricante
• http://secunia.com/advisories/14217 · Nota
• http://debian.org/security/2005/dsa-677 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-01967 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2005-0073 · Nota de Segurança
• http://debian.org/security/dsa-677 · Nota
• http://securitytracker.com/id?1013163 · Nota