PT-2005-1042 · Gtk+ · Gtkdiskfree

Eric Romang · Publicado 2005-09-15 · Atualizado 2016-10-18 · CVE-2005-2918

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions gtkdiskfree version 1.9.3 and earlier

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the gtkdiskfree temporary file, potentially leading to data integrity violations. Additionally, there are multiple vulnerabilities in the gtkdiskfree package that can be exploited remotely, compromising the integrity of protected information.

Recommendations For gtkdiskfree version 1.9.3 and earlier, consider restricting access to the open cmd tube function in mount.c until a patch is available. As a temporary workaround, avoid using the open cmd tube function to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-03280

CVE-2005-2918

DSA-822-1

Produtos afetados

Gtkdiskfree

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-2918 · Nota de Segurança
• http://debian.org/security/2005/dsa-822 · Aviso do Fabricante
• http://debian.org/security/dsa-822 · Nota
• https://bdu.fstec.ru/vul/2015-03280 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112680706715109&w=2 · Nota
• http://secunia.com/advisories/17005 · Nota
• http://zataz.net/adviso/gtkdiskfree-09052005.txt · Aviso do Fabricante
• http://secunia.com/advisories/16951 · Nota
• http://gentoo.org/security/en/glsa/glsa-200510-01.xml · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2918 · Nota de Segurança
• http://bugs.gentoo.org/show_bug.cgi?id=104565 · Aviso do Fabricante
• http://secunia.com/advisories/17056 · Nota