PT-2005-1031 · Debian · Smartlist

Jeroen Van Wolffelaar · Published 2005-05-03 · Updated 2008-09-10 · CVE-2005-0157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SmartList versions 3.15 and earlier

Description The issue allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned. Multiple vulnerabilities in the SmartList package of the Debian GNU/Linux operating system can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For SmartList versions 3.15 and earlier, consider disabling the confirm add-on functionality until a patch is available to prevent attackers from subscribing arbitrary e-mail addresses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-03097

CVE-2005-0157

DSA-720-1

Affected Products

Smartlist

References · 8

• https://bdu.fstec.ru/vul/2015-03097 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0157 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-0157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0157 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0157 · Security Note
• http://debian.org/security/dsa-720 · Note
• http://debian.org/security/2005/dsa-720 · Patch, Vendor Advisory