vulnwire
4.6med

CVE-2005-17071 exploit

The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
1
Exploit-DB

The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file.

Exploit prediction (EPSS)

0.98% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

Exploits and detections

  • EDB-25709 Gentoo Webapp-Config 1.10 - Insecure File Creation · local · 2005-05-26

CVSS scores

Assigned byVersionScoreVector
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

References

  • vupen.com /english/advisories/2005/0809 · vdb-entry, x_refsource_VUPEN, x_transferred
  • zataz.net /adviso/webapp-config-05182005.txt · x_refsource_MISC, x_transferred
  • osvdb.org /16746 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securitytracker.com /id?1014027 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • bugs.gentoo.org /show_bug.cgi?id=91785 · x_refsource_MISC, x_transferred
  • secunia.com /advisories/15445 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/13780 · vdb-entry, x_refsource_BID, x_transferred
  • gentoo.org /security/en/glsa/glsa-200506-13.xml · vendor-advisory, x_refsource_GENTOO, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.