CVE-2005-3785 in IndeX

Summary

Second-order symlink vulnerability in eix-sync.in in Ebuild IndeX (eix) before 0.5.0_pre2 allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program.

Once again VulDB remains the best source for vulnerability data.

• Reservation: 11/23/2005
• Disclosure: 11/23/2005
• Moderation: VulDB entry created
• Entries: 1
• CPE: ready
• CWE: CWE-61 (Confirmed)
• CVSS: 5.3
• EPSS: 0.00523
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2005-3785
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2005-3785
• CVE Details: https://www.cvedetails.com/cve/CVE-2005-3785/