PT-2005-1007 · Sympa · Sympa

Erik Sjölund · Published 2005-02-11 · Updated 2008-09-05 · CVE-2005-0073

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sympa version 3.3.3

Description The issue is related to a buffer overflow in the queue.c file of a support script for sympa. This can allow local users to execute arbitrary code when the script is run with setuid privileges. Additionally, there are multiple vulnerabilities in the wwsympa package that can lead to breaches of confidentiality, integrity, and availability of protected information, potentially exploitable by local attackers.

Recommendations For sympa version 3.3.3, consider restricting the execution of the support script or removing setuid privileges as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-01967

CVE-2005-0073

DSA-677-1

Affected Products

Sympa

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0073 · Security Note
• https://osv.dev/vulnerability/CVE-2005-0073 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0073 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0073 · Vendor Advisory
• http://debian.org/security/2005/dsa-677 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-0073 · Security Note
• http://secunia.com/advisories/14224 · Note
• http://secunia.com/advisories/14217 · Note
• http://debian.org/security/dsa-677 · Note
• http://securitytracker.com/id?1013163 · Note