PT-2005-1078 · Gnome+2 · Gnome-Vfs2+4

David Lawrence + 1 · Published 2005-03-09 · Updated 2017-10-11 · CVE-2005-0706

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gnome-vfs versions 1.0.1 gnome-vfs-devel version 1.0.1 gnome-vfs2 (affected versions not specified) grip version 3.1.2

Description The issue allows for remote exploitation, potentially leading to a breach of confidentiality, integrity, and availability of protected information. It involves a buffer overflow in discdb.c for grip, which can cause a denial of service and possibly execute arbitrary code by returning more matches than expected during the cddb lookup.

Recommendations For gnome-vfs versions 1.0.1, update to a version that includes the necessary security patches. For gnome-vfs-devel version 1.0.1, apply the relevant security fixes to prevent exploitation. For gnome-vfs2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For grip version 3.1.2, consider disabling the cddb lookup functionality until a patch is available to prevent potential code execution.

Related Identifiers

BDU:2015-07235

BDU:2015-07236

BDU:2015-07237

CVE-2005-0706

RHSA-2009:0005

RHSA-2009_0005

Affected Products

Red Hat

Gnome-Vfs

Gnome-Vfs-Devel

Gnome-Vfs2

Grip

References · 26

• http://redhat.com/support/errata/RHSA-2005-304.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0706 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0706 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00490.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0706 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0005.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07236 · Security Note
• https://osv.dev/vulnerability/CVE-2005-0706 · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152919 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07237 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00429.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07235 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-February/msg00188.html · Vendor Advisory
• http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10768 · Note