CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1992 vulnerabilities reference this CWE, most recent first.
GHSA-7CPF-464X-JV68
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2024-04-04 00:41Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2019-0086"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-17T16:29:00Z",
"severity": "HIGH"
},
"details": "Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-7cpf-464x-jv68",
"modified": "2024-04-04T00:41:37Z",
"published": "2022-05-24T16:45:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0086"
},
{
"type": "WEB",
"url": "https://danishcyberdefence.dk/blog/dal"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K35815741"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CQH-9WJJ-HHF9
Vulnerability from github – Published: 2022-05-01 23:42 – Updated: 2025-04-09 03:53vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
{
"affected": [],
"aliases": [
"CVE-2008-1694"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-04-22T04:41:00Z",
"severity": "MODERATE"
},
"details": "vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.",
"id": "GHSA-7cqh-9wjj-hhf9",
"modified": "2025-04-09T03:53:52Z",
"published": "2022-05-01T23:42:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1694"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=208483"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41906"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/607-1"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=216880"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29905"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29926"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30109"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:096"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28857"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1019909"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1309/references"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1310/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7CR3-H577-G38J
Vulnerability from github – Published: 2026-07-06 20:15 – Updated: 2026-07-06 20:15The --preserve-root check uses a path-string test (path.has_root() && path.parent().is_none()) rather than comparing device/inode. A symlink to / (e.g. /tmp/rootlink -> /) has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it.
Impact: rm -rf --preserve-root on a path that resolves through a symlink to / bypasses protection and can delete system directories. Recommendation: compare each entered directory's dev/inode against cached /.
Remediation: Acknowledged by Canonical; fixed in commit 5e5968cd.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.44. Credit: Zellic.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_rm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35349"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T20:15:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The `--preserve-root` check uses a path-string test (`path.has_root() \u0026\u0026 path.parent().is_none()`) rather than comparing device/inode. A symlink to `/` (e.g. `/tmp/rootlink -\u003e /`) has a parent component, so it passes the check. GNU caches `/`\u0027s dev/inode at startup and compares every traversed directory against it.\n\n**Impact:** `rm -rf --preserve-root` on a path that resolves through a symlink to `/` bypasses protection and can delete system directories. Recommendation: compare each entered directory\u0027s dev/inode against cached `/`.\n\n**Remediation:** Acknowledged by Canonical; fixed in commit 5e5968cd.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.44. Credit: Zellic._",
"id": "GHSA-7cr3-h577-g38j",
"modified": "2026-07-06T20:15:27Z",
"published": "2026-07-06T20:15:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-7cr3-h577-g38j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35349"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/9706"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)"
}
GHSA-7CRM-H967-F3PF
Vulnerability from github – Published: 2022-06-29 00:00 – Updated: 2022-07-09 00:00Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
{
"affected": [],
"aliases": [
"CVE-2022-2145"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-28T18:15:00Z",
"severity": "HIGH"
},
"details": "Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.",
"id": "GHSA-7crm-h967-f3pf",
"modified": "2022-07-09T00:00:25Z",
"published": "2022-06-29T00:00:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2145"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CV3-GVMC-8MQ5
Vulnerability from github – Published: 2022-05-14 01:27 – Updated: 2023-07-03 21:44During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger"
},
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-12026"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T23:01:47Z",
"nvd_published_at": "2018-06-17T20:29:00Z",
"severity": "CRITICAL"
},
"details": "During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.",
"id": "GHSA-7cv3-gvmc-8mq5",
"modified": "2023-07-03T21:44:25Z",
"published": "2022-05-14T01:27:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12026"
},
{
"type": "WEB",
"url": "https://github.com/phusion/passenger/commit/fd3717a3cd357aa0e80e1e81d4dc94a1eaf928f1"
},
{
"type": "WEB",
"url": "https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes"
},
{
"type": "WEB",
"url": "https://blog.phusion.nl/passenger-5-3-2"
},
{
"type": "PACKAGE",
"url": "https://github.com/phusion/passenger"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12026.yml"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201807-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability"
}
GHSA-7CX2-G3H9-382P
Vulnerability from github – Published: 2026-06-16 21:02 – Updated: 2026-06-16 21:02Summary
Three backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF output_path.
1. Arbitrary file write via output_path symlink / TOCTOU (primary)
POST /screenshot and POST /pdf accept an output_path constrained to ALLOWED_OUTPUT_DIR by validate_output_path. The 0.8.7 check was string-only: it did not resolve symlinks, so a symlinked path component inside the output directory could redirect the write outside the directory, and the final open() followed symlinks. On a deployment where the runtime user can write executable/cron locations this is an arbitrary-write to code-execution primitive. The API is unauthenticated by default.
Fix: validate_output_path now resolves the real path (symlinks) of the parent and re-checks containment, and the write uses O_NOFOLLOW (write_output_file). output_path remains supported.
2. CRLF log injection (CWE-117)
User-controlled URLs/errors reflected into log lines could embed CR/LF and forge additional log entries. Fix: a logging filter strips CR/LF/control characters from all records.
3. Webhook request-header injection (CWE-93/CWE-113)
User-supplied webhook headers were sent verbatim, allowing CRLF and hop-by-hop / sensitive header injection on the outbound webhook request. Fix: webhook headers are validated (name pattern, no control characters, deny Host/Content-Length/Transfer-Encoding/Authorization/Cookie/...), with early request-time rejection.
Impact
Arbitrary file write (potential code execution) for #1; log forging for #2; request smuggling / header injection on outbound webhooks for #3.
Workarounds
- Upgrade to the patched version.
- Enable authentication (
CRAWL4AI_API_TOKEN). - Run the container with a read-only root filesystem.
Credits
Internal security audit (Crawl4AI maintainers).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.7"
},
"package": {
"ecosystem": "PyPI",
"name": "crawl4ai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-117",
"CWE-22",
"CWE-59",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-16T21:02:19Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nThree backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF `output_path`.\n\n### 1. Arbitrary file write via output_path symlink / TOCTOU (primary)\n\n`POST /screenshot` and `POST /pdf` accept an `output_path` constrained to `ALLOWED_OUTPUT_DIR` by `validate_output_path`. The 0.8.7 check was string-only: it did not resolve symlinks, so a symlinked path component inside the output directory could redirect the write outside the directory, and the final `open()` followed symlinks. On a deployment where the runtime user can write executable/cron locations this is an arbitrary-write to code-execution primitive. The API is unauthenticated by default.\n\nFix: `validate_output_path` now resolves the real path (symlinks) of the parent and re-checks containment, and the write uses `O_NOFOLLOW` (`write_output_file`). `output_path` remains supported.\n\n### 2. CRLF log injection (CWE-117)\n\nUser-controlled URLs/errors reflected into log lines could embed CR/LF and forge additional log entries. Fix: a logging filter strips CR/LF/control characters from all records.\n\n### 3. Webhook request-header injection (CWE-93/CWE-113)\n\nUser-supplied webhook headers were sent verbatim, allowing CRLF and hop-by-hop / sensitive header injection on the outbound webhook request. Fix: webhook headers are validated (name pattern, no control characters, deny `Host`/`Content-Length`/`Transfer-Encoding`/`Authorization`/`Cookie`/...), with early request-time rejection.\n\n### Impact\n\nArbitrary file write (potential code execution) for #1; log forging for #2; request smuggling / header injection on outbound webhooks for #3.\n\n### Workarounds\n\n- Upgrade to the patched version.\n- Enable authentication (`CRAWL4AI_API_TOKEN`).\n- Run the container with a read-only root filesystem.\n\n### Credits\n\nInternal security audit (Crawl4AI maintainers).",
"id": "GHSA-7cx2-g3h9-382p",
"modified": "2026-06-16T21:02:19Z",
"published": "2026-06-16T21:02:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p"
},
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai/issues/1"
},
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/unclecode/crawl4ai/pull/3"
},
{
"type": "PACKAGE",
"url": "https://github.com/unclecode/crawl4ai"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server"
}
GHSA-7F4W-GQ3X-VM5M
Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.
{
"affected": [],
"aliases": [
"CVE-2023-50197"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:16:05Z",
"severity": "HIGH"
},
"details": "Intel Driver \u0026 Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver \u0026 Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.",
"id": "GHSA-7f4w-gq3x-vm5m",
"modified": "2024-05-03T03:31:05Z",
"published": "2024-05-03T03:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50197"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1773"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7F63-6J3V-P9VW
Vulnerability from github – Published: 2022-05-01 01:46 – Updated: 2022-05-01 01:46The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.
{
"affected": [],
"aliases": [
"CVE-2005-0004"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-04-14T04:00:00Z",
"severity": "MODERATE"
},
"details": "The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.",
"id": "GHSA-7f63-6j3v-p9vw",
"modified": "2022-05-01T01:46:48Z",
"published": "2022-05-01T01:46:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0004"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18922"
},
{
"type": "WEB",
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000947"
},
{
"type": "WEB",
"url": "http://lists.mysql.com/internals/20600"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=110608297217224\u0026w=2"
},
{
"type": "WEB",
"url": "http://mysql.osuosl.org/doc/mysql/en/News-4.1.10.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/13867"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-101864-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2005/dsa-647"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:036"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/12277"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7FMV-J8G9-PP43
Vulnerability from github – Published: 2022-05-01 23:42 – Updated: 2022-05-01 23:42inetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-1684"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-04-06T23:44:00Z",
"severity": "MODERATE"
},
"details": "inetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.",
"id": "GHSA-7fmv-j8g9-pp43",
"modified": "2022-05-01T23:42:27Z",
"published": "2022-05-01T23:42:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1684"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41626"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5369"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29654"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1019781"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-233284-1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28584"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1076"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7FQM-4MW8-JRHJ
Vulnerability from github – Published: 2022-05-01 02:09 – Updated: 2022-05-01 02:09Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.
{
"affected": [],
"aliases": [
"CVE-2005-2527"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-12-31T05:00:00Z",
"severity": "LOW"
},
"details": "Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.",
"id": "GHSA-7fqm-4mw8-jrhj",
"modified": "2022-05-01T02:09:06Z",
"published": "2022-05-01T02:09:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2527"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22262"
},
{
"type": "WEB",
"url": "http://docs.info.apple.com/article.html?artnum=302266"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2005/Sep/msg00001.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/16808"
},
{
"type": "WEB",
"url": "http://www.ciac.org/ciac/bulletins/p-306.shtml"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/14825"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2005/1734"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.