Lucene search

[email protected]CVE-2006-5215

HistoryOct 10, 2006 - 4:06 a.m.

CVE-2006-5215

2006-10-1004:06:00

[email protected]

web.nvd.nist.gov

xsession script

xdm

symlink attack

local users

security vulnerability

nvd

cve-2006-5215

2.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.4%

JSON

The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user’s Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.

Affected configurations

NVD

Node

x.orgxdmRange≤1.0.3

Node

netbsdnetbsdRange≤current

netbsdnetbsdMatch1.0

netbsdnetbsdMatch1.1

netbsdnetbsdMatch1.2

netbsdnetbsdMatch1.2.1

netbsdnetbsdMatch1.3

netbsdnetbsdMatch1.3.1

netbsdnetbsdMatch1.3.2

netbsdnetbsdMatch1.3.3

netbsdnetbsdMatch1.4

netbsdnetbsdMatch1.4alpha

netbsdnetbsdMatch1.4arm32

netbsdnetbsdMatch1.4sparc

netbsdnetbsdMatch1.4x86

netbsdnetbsdMatch1.4.1

netbsdnetbsdMatch1.4.1alpha

netbsdnetbsdMatch1.4.1arm32

netbsdnetbsdMatch1.4.1sh3

netbsdnetbsdMatch1.4.1sparc

netbsdnetbsdMatch1.4.1x86

netbsdnetbsdMatch1.4.2

netbsdnetbsdMatch1.4.2alpha

netbsdnetbsdMatch1.4.2arm32

netbsdnetbsdMatch1.4.2sparc

netbsdnetbsdMatch1.4.2x86

netbsdnetbsdMatch1.4.3

netbsdnetbsdMatch1.5

netbsdnetbsdMatch1.5sh3

netbsdnetbsdMatch1.5x86

netbsdnetbsdMatch1.5.1

netbsdnetbsdMatch1.5.2

netbsdnetbsdMatch1.5.3

netbsdnetbsdMatch1.6

netbsdnetbsdMatch1.6beta

netbsdnetbsdMatch1.6.1

netbsdnetbsdMatch1.6.2

netbsdnetbsdMatch2.0

netbsdnetbsdMatch2.0.1

netbsdnetbsdMatch2.0.2

netbsdnetbsdMatch2.0.3

netbsdnetbsdMatch2.1

netbsdnetbsdMatch3.0

netbsdnetbsdMatch3.99.15

netbsdnetbsdMatch4.0

sunsolarisMatch8.0sparc

sunsolarisMatch8.0x86

sunsolarisMatch8.0beta

sunsolarisMatch9.0sparc

sunsolarisMatch9.0x86

sunsolarisMatch9.0x86_update_2

sunsolarisMatch10.0sparc

sunsunosMatch5.8

sunsunosMatch5.9

CPENameOperatorVersion
x.org:xdmx.org xdmle1.0.3

CPE	Name	Operator	Version
x.org:xdm	x.org xdm	le	1.0.3

References

secunia.com/advisories/22992

securitytracker.com/id?1017015

sunsolve.sun.com/search/document.do?assetkey=1-26-102652-1

support.avaya.com/elmodocs2/security/ASA-2006-250.htm

www.netbsd.org/cgi-bin/query-pr-single.pl?number=32805

bugs.freedesktop.org/show_bug.cgi?id=5898

exchange.xforce.ibmcloud.com/vulnerabilities/29427

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2205

2.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.4%

JSON

Related for CVE-2006-5215

cvelist1 debiancve1 nvd1 nessus6