PT-2005-5585 · Debian · Ppxp-Dev+4

Jens Steube · Published 1970-01-01 · Updated 2008-11-15 · CVE-2005-0392

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ppxp-tcltk versions (affected versions not specified) ppxp versions (affected versions not specified) ppxp-dev versions (affected versions not specified) ppxp-x11 versions (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the ppxp package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker. Specifically, ppxp does not drop root privileges before opening log files, allowing local users to execute arbitrary commands.

Recommendations For ppxp-tcltk, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ppxp, consider restricting access to the log files until a patch is available. For ppxp-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ppxp-x11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-03102

BDU:2015-03103

BDU:2015-03104

BDU:2015-03105

CVE-2005-0392

DSA-725-1

DSA-725-2

Affected Products

Debian

Ppxp

Ppxp-Dev

Ppxp-Tcltk

Ppxp-X11

References · 9

• https://bdu.fstec.ru/vul/2015-03102 · Security Note
• https://bdu.fstec.ru/vul/2015-03105 · Security Note
• http://debian.org/security/2005/dsa-725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03103 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0392 · Security Note
• https://bdu.fstec.ru/vul/2015-03104 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-0392 · Security Note
• http://debian.org/security/dsa-725 · Note
• http://securityfocus.com/bid/13681 · Note