Lucene search

[email protected]CVE-2005-3254

HistoryOct 18, 2005 - 9:02 p.m.

CVE-2005-3254

2005-10-1821:02:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2005-3254

cgiwrap

debian gnu/linux

uid manipulation

security vulnerability

nvd

7.2 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

68.0%

JSON

The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.

CPENameOperatorVersion
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.21
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.8
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq1.0
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq2.1
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.6.2
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.2
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.7.1
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.6.4
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.1
nathan_neulinger:cgiwrapnathan neulinger cgiwrapeq3.23

CPE	Name	Operator	Version
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.21
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.8
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	1.0
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	2.1
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.6.2
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.2
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.7.1
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.6.4
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.1
nathan_neulinger:cgiwrap	nathan neulinger cgiwrap	eq	3.23

Rows per page:

1-10 of 291

References

lists.alioth.debian.org/pipermail/secure-testing-announce/2005-August/000003.html

7.2 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

68.0%

JSON

Related for CVE-2005-3254

ubuntucve1