CVE-2005-3349

Published: Nov 18, 2005Modified: Apr 16, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file.

Affected (8)

Products: Gnu: Gnump3d

Gnu

1 product

Gnump3d

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnump3d	Up to 2.9.7
Gnu Gnump3d	Version 2.9.1
Gnu Gnump3d	Version 2.9.2
Gnu Gnump3d	Version 2.9.3
Gnu Gnump3d	Version 2.9.4
Gnu Gnump3d	Version 2.9.5
Gnu Gnump3d	Version 2.9.6
Gnu Gnump3d	Version 2.9

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (20)

http://secunia.com/advisories/17646

Source: security@debian.org

PatchVendor Advisory

http://secunia.com/advisories/17647

Source: security@debian.org

PatchVendor Advisory

http://secunia.com/advisories/17656

Source: security@debian.org

PatchVendor Advisory

http://www.debian.org/security/2005/dsa-901

Source: security@debian.org

Patch

http://www.gentoo.org/security/en/glsa/glsa-200511-16.xml

Source: security@debian.org

Patch

http://www.gnu.org/software/gnump3d/ChangeLog

Source: security@debian.org

Patch

http://www.gnu.org/software/gnump3d/attacks.html#temporary-files

Source: security@debian.org

http://www.novell.com/linux/security/advisories/2005_28_sr.html

Source: security@debian.org

PatchVendor Advisory

http://www.securityfocus.com/bid/15497

Source: security@debian.org

Patch

http://www.vupen.com/english/advisories/2005/2489

Source: security@debian.org

Vendor Advisory

http://secunia.com/advisories/17646