CVE-2005-2136

Published: Jul 5, 2005Modified: Apr 16, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.

Affected (5)

Products: Raritan: Dominion Sx4 Firmware, Dominion Sx8 Firmware, Dominion Sx16 Firmware, Dominion Sx32 Firmware, Dominion Sxa 48 Firmware

Raritan

5 products

Dominion Sx4 Firmware

Dominion Sx8 Firmware

Dominion Sx16 Firmware

Dominion Sx32 Firmware

Dominion Sxa 48 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Raritan Dominion Sx4 Firmware	All versions

Running on/with	Platform Versions
Raritan Dominion Sx4	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Raritan Dominion Sx8 Firmware	All versions

Running on/with	Platform Versions
Raritan Dominion Sx8	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Raritan Dominion Sx16 Firmware	All versions

Running on/with	Platform Versions
Raritan Dominion Sx16	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Raritan Dominion Sx32 Firmware	Version 2.4.6

Running on/with	Platform Versions
Raritan Dominion Sx32	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Raritan Dominion Sxa 48 Firmware	All versions

Running on/with	Platform Versions
Raritan Dominion Sxa 48	All versions

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

http://seclists.org/lists/bugtraq/2005/Jun/0251.html

Source: cve@mitre.org

ExploitMailing ListPatchThird Party AdvisoryVendor Advisory

http://secunia.com/advisories/15853

Source: cve@mitre.org

Not ApplicablePatchVendor Advisory

http://www.securityfocus.com/bid/14084

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://seclists.org/lists/bugtraq/2005/Jun/0251.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListPatchThird Party AdvisoryVendor Advisory

http://secunia.com/advisories/15853

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicablePatchVendor Advisory

http://www.securityfocus.com/bid/14084

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

Timeline

No history available yet.