CVE-2005-2960

LOW 2.1CVE-2005-2960 · Published 05/10/2005 · updated 16/06/2026

In short

CVE-2005-2960 is a LOW (CVSS 2.1) vulnerability affecting cfengine (gnu).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cfengine gnu	`= 1.5= 1.5.3-4= 1.6= 1.6.5= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.1.0= 2.1.16= 2.1.7= 2.1.8= 2.1.9`	No fix yet

Description

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

References

bugs.gentoo.org/show_bug.cgi · Vendor Advisory
groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0 · Patch
secunia.com/advisories/17037 · Vendor Advisory
secunia.com/advisories/17038
secunia.com/advisories/17040
secunia.com/advisories/17142
secunia.com/advisories/17182
secunia.com/advisories/17215
debian.org/security/2005/dsa-835 · Patch
debian.org/security/2005/dsa-836 · Patch
mandriva.com/security/advisories
novell.com/linux/security/advisories/2005_23_sr.html
securityfocus.com/bid/14994
ubuntu.com/usn/usn-198-1

More vulnerabilities in cfengine

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free