PT-2005-1073 · Gnu+1 · Sharutils+1

Joey Hess · Published 2005-04-06 · Updated 2018-10-03 · CVE-2005-0990

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sharutils version 4.2.1

Description The issue affects the sharutils package in Red Hat Enterprise Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Specifically, the unshar function in unshar.c allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file.

Recommendations For sharutils version 4.2.1, consider restricting access to the unshar function until a patch is available. As a temporary workaround, avoid using the unshar function to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-06532

CVE-2005-0990

RHSA-2005:377

RHSA-2005_377

Affected Products

Red Hat

Sharutils

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2005-0990 · Security Note
• http://redhat.com/support/errata/RHSA-2005-377.html · Vendor Advisory
• https://bugzilla.ubuntu.com/show_bug.cgi?id=8459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0990 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0990 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0990 · Vendor Advisory
• https://usn.ubuntu.com/104-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06532 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=302412 · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2004-1773.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19957 · Note
• http://securityfocus.com/archive/1/359639 · Note
• https://redhat.com/security/data/cve/CVE-2005-0990.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9613 · Note
• https://redhat.com/security/data/cve/CVE-2004-1772.html · Note