CVE-2006-0055: Low severity FreeBSD FreeBSD vulnerability
Published Jan 11, 2006
·Updated
The ispellop function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell.
Affected Software
28 affected components
FreeBSD FreeBSD=4.10
FreeBSD FreeBSD=4.10-release
FreeBSD FreeBSD=4.10-release_p8
FreeBSD FreeBSD=4.10-releng
FreeBSD FreeBSD=4.11-release_p3
FreeBSD FreeBSD=4.11-releng
FreeBSD FreeBSD=4.11-stable
FreeBSD FreeBSD=5.0
FreeBSD FreeBSD=5.0-alpha
FreeBSD FreeBSD=5.0-release_p14
FreeBSD FreeBSD=5.0-releng
FreeBSD FreeBSD=5.1
FreeBSD FreeBSD=5.1-alpha
FreeBSD FreeBSD=5.1-release
FreeBSD FreeBSD=5.1-release_p5
FreeBSD FreeBSD=5.1-releng
FreeBSD FreeBSD=5.2
FreeBSD FreeBSD=5.2.1-release
FreeBSD FreeBSD=5.2.1-releng
FreeBSD FreeBSD=5.3
FreeBSD FreeBSD=5.3-release
FreeBSD FreeBSD=5.3-releng
FreeBSD FreeBSD=5.3-stable
FreeBSD FreeBSD=5.4-pre-release
FreeBSD FreeBSD=5.4-release
FreeBSD FreeBSD=5.4-releng
FreeBSD FreeBSD=6.0-release
FreeBSD FreeBSD=6.0-stable
Remediation
Patch Available
Patch Available
Event History
Jan 11, 2006
CVE Published
09:03 PM
Jan 12, 2006
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-0055?
CVE-2006-0055 is considered a moderate severity vulnerability due to the potential for local users to overwrite arbitrary files.
2
How do I fix CVE-2006-0055?
To fix CVE-2006-0055, you should update your FreeBSD system to a version that addresses this vulnerability.
3
What systems are affected by CVE-2006-0055?
CVE-2006-0055 affects FreeBSD versions ranging from 4.10 to 6.0.
4
Can CVE-2006-0055 be exploited remotely?
CVE-2006-0055 cannot be exploited remotely as it requires local access to the system.
5
What kind of attack does CVE-2006-0055 involve?
CVE-2006-0055 involves a symlink attack which allows local users to manipulate file writes.