CVE-2005-0159: Medium severity Debian toolchain-source vulnerability
Published Feb 15, 2005
·Updated
The tpkg- scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
Affected Software
16 affected components
Debian toolchain-source=3.0.3-2
Debian toolchain-source=3.0.4
Debian toolchain-source=3.0.3-3
Debian toolchain-source=3.0.3-1
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Debian Debian Linux=3.0
Remediation
Patch Available
Patch Available
Event History
Feb 15, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0159?
CVE-2005-0159 is considered a medium-severity vulnerability due to the risk of file overwrites by local users.
2
How do I fix CVE-2005-0159?
To mitigate CVE-2005-0159, upgrade the toolchain-source package to a fixed version that addresses the symlink vulnerability.
3
What are the impacted versions of toolchain-source in relation to CVE-2005-0159?
The affected versions are toolchain-source 3.0.3-1, 3.0.3-2, and 3.0.4 on Debian GNU/Linux 3.0.
4
Who is affected by CVE-2005-0159?
Local users on systems running the vulnerable versions of toolchain-source are affected by CVE-2005-0159.
5
What type of attack is used in CVE-2005-0159?
CVE-2005-0159 can be exploited using a symlink attack on temporary files created by the tpkg-* scripts.