PT-2005-2870 · Centericq · Centericq

Eric Romang · Published 2005-07-17 · Updated 2008-09-05 · CVE-2005-1914

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CenterICQ versions 4.20.0 and earlier

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the gg.token.PID temporary file. This is due to the creation of temporary files with predictable file names.

Recommendations For versions 4.20.0 and earlier, consider restricting access to the temporary file directory to prevent symlink attacks until a patch is available. As a temporary workaround, avoid using the gg.token.PID temporary file or restrict its usage to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-1914

DSA-754-1

DTSA-2-1

Affected Products

Centericq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-1914 · Security Note
• http://debian.org/security/2005/dsa-754 · Vendor Advisory
• http://zataz.net/adviso/centericq-06152005.txt · Vendor Advisory
• http://securityfocus.com/bid/14144 · Note