PT-2005-2870 · Centericq · Centericq

Eric Romang · Publicado 2005-07-17 · Atualizado 2008-09-05 · CVE-2005-1914

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CenterICQ versions 4.20.0 and earlier

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the gg.token.PID temporary file. This is due to the creation of temporary files with predictable file names.

Recommendations For versions 4.20.0 and earlier, consider restricting access to the temporary file directory to prevent symlink attacks until a patch is available. As a temporary workaround, avoid using the gg.token.PID temporary file or restrict its usage to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-1914

DSA-754-1

DTSA-2-1

Produtos afetados

Centericq

Referências · 4

• http://securityfocus.com/bid/14144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1914 · Nota de Segurança
• http://debian.org/security/2005/dsa-754 · Aviso do Fabricante
• http://zataz.net/adviso/centericq-06152005.txt · Aviso do Fabricante