PT-2005-1042 · Gtk+ · Gtkdiskfree

Eric Romang · Published 2005-09-15 · Updated 2016-10-18 · CVE-2005-2918

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions gtkdiskfree version 1.9.3 and earlier

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the gtkdiskfree temporary file, potentially leading to data integrity violations. Additionally, there are multiple vulnerabilities in the gtkdiskfree package that can be exploited remotely, compromising the integrity of protected information.

Recommendations For gtkdiskfree version 1.9.3 and earlier, consider restricting access to the open cmd tube function in mount.c until a patch is available. As a temporary workaround, avoid using the open cmd tube function to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-03280

CVE-2005-2918

DSA-822-1

Affected Products

Gtkdiskfree

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-2918 · Security Note
• http://debian.org/security/2005/dsa-822 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03280 · Security Note
• http://zataz.net/adviso/gtkdiskfree-09052005.txt · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200510-01.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2918 · Security Note
• http://bugs.gentoo.org/show_bug.cgi?id=104565 · Vendor Advisory
• http://debian.org/security/dsa-822 · Note
• http://marc.info/?l=bugtraq&m=112680706715109&w=2 · Note
• http://secunia.com/advisories/17005 · Note
• http://secunia.com/advisories/16951 · Note
• http://secunia.com/advisories/17056 · Note