CVE-2005-0205

2005-05-0204:00:00

mitre

web.nvd.nist.gov

kppp

kde 3.1.5

cve-2005-0205

information security

local privilege escalation

file descriptor vulnerability

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.1

Confidence

Low

EPSS

Percentile

5.1%

JSON

KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.

Affected configurations

Nvd

Node

bernd_wuebbenkpppMatch2.1.2

kdekdeMatch3.1

kdekdeMatch3.1.1

kdekdeMatch3.1.2

kdekdeMatch3.1.3

kdekdeMatch3.1.4

kdekdeMatch3.1.5

VendorProductVersionCPE
bernd_wuebbenkppp2.1.2cpe:2.3:o:bernd_wuebben:kppp:2.1.2:*:*:*:*:*:*:*
kdekde3.1cpe:2.3:o:kde:kde:3.1:*:*:*:*:*:*:*
kdekde3.1.1cpe:2.3:o:kde:kde:3.1.1:*:*:*:*:*:*:*
kdekde3.1.2cpe:2.3:o:kde:kde:3.1.2:*:*:*:*:*:*:*
kdekde3.1.3cpe:2.3:o:kde:kde:3.1.3:*:*:*:*:*:*:*
kdekde3.1.4cpe:2.3:o:kde:kde:3.1.4:*:*:*:*:*:*:*
kdekde3.1.5cpe:2.3:o:kde:kde:3.1.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bernd_wuebben	kppp	2.1.2	cpe:2.3:o:bernd_wuebben:kppp:2.1.2:::::::*
kde	kde	3.1	cpe:2.3:o:kde:kde:3.1:::::::*
kde	kde	3.1.1	cpe:2.3:o:kde:kde:3.1.1:::::::*
kde	kde	3.1.2	cpe:2.3:o:kde:kde:3.1.2:::::::*
kde	kde	3.1.3	cpe:2.3:o:kde:kde:3.1.3:::::::*
kde	kde	3.1.4	cpe:2.3:o:kde:kde:3.1.4:::::::*
kde	kde	3.1.5	cpe:2.3:o:kde:kde:3.1.5:::::::*