CVE-2005-4889

HIGH

Description

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

References

http://distrib-coffee.ipsl.jussieu.fr/pub/mirrors/rpm/files/rpm/rpm-4.4/rpm-4.4.3.tar.gz

http://www.mandriva.com/security/advisories?name=MDVSA-2010:180

https://bugzilla.redhat.com/show_bug.cgi?id=125517

https://bugzilla.redhat.com/show_bug.cgi?id=598775

https://exchange.xforce.ibmcloud.com/vulnerabilities/59426

Details

Source: MITRE

Published: 2010-06-08

Updated: 2017-08-17

Type: CWE-264

Risk Information

CVSS v2.0

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.9

Severity: HIGH