CVE-2005-0205

2005-05-0204:00:00

[email protected]

web.nvd.nist.gov

kppp

kde 3.1.5

cve-2005-0205

information security

local privilege escalation

file descriptor vulnerability

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.

Affected configurations

NVD

Node

bernd_wuebbenkpppMatch2.1.2

kdekdeMatch3.1

kdekdeMatch3.1.1

kdekdeMatch3.1.2

kdekdeMatch3.1.3

kdekdeMatch3.1.4

kdekdeMatch3.1.5

CPENameOperatorVersion
bernd_wuebben:kpppbernd wuebben kpppeq2.1.2
kde:kdekdeeq3.1
kde:kdekdeeq3.1.1
kde:kdekdeeq3.1.2
kde:kdekdeeq3.1.3
kde:kdekdeeq3.1.4
kde:kdekdeeq3.1.5