CVE-2005-4660 - Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite syst

CVE-2005-4660

Summary

Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from this backup.

References

Vulnerable Configurations

cpe:2.3:a:ipcop:ipcop:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.9:*:*:*:*:*:*:*
cpe:2.3:a:ipcop:ipcop:1.4.9:*:*:*:*:*:*:*

CVSS

Base:	1.2 (as of 05-09-2008 - 20:57)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:L/AC:H/Au:N/C:N/I:P/A:N

refmap via4

bid	15378
confirm	http://sourceforge.net/tracker/index.php?func=detail&aid=1344047&group_id=40604&atid=428516
secunia	17513

Last major update

05-09-2008 - 20:57

Published

31-12-2005 - 05:00

Last modified

05-09-2008 - 20:57