CVE-2005-4802 - Flexbackup 1.2.1 and earlier allows local users to overwrite files and execute code via a symlink at

CVE-2005-4802

Summary

Flexbackup 1.2.1 and earlier allows local users to overwrite files and execute code via a symlink attack on temporary files. NOTE: the raw source referenced an incorrect candidate number; this is the correct number to use.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334350
http://marc.info/?l=bugtraq&m=112958392512513&w=2
http://secunia.com/advisories/17209
http://secunia.com/advisories/23008
http://securitytracker.com/id?1015068
http://www.debian.org/security/2006/dsa-1216
http://www.zataz.net/adviso/flexbackup-09192005.txt

Vulnerable Configurations

cpe:2.3:a:flexbackup:flexbackup:*:*:*:*:*:*:*:*
cpe:2.3:a:flexbackup:flexbackup:*:*:*:*:*:*:*:*

CVSS

Base:	4.6 (as of 18-10-2016 - 03:38)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20051017 flexbackup default config insecure temporary file creation
confirm	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334350
debian	DSA-1216
misc	http://www.zataz.net/adviso/flexbackup-09192005.txt
sectrack	1015068
secunia	17209 23008

Last major update

18-10-2016 - 03:38

Published

31-12-2005 - 05:00

Last modified

18-10-2016 - 03:38