CVE-2005-1111: canonical ubuntu_linux Link Following
CVSS: 4.7v3.1MediumModified
AliasesRHSA-2005:378DEBIAN-CVE-2005-1111
Published 16-04-2005Last modified 07-08-2024
Some data may be incomplete
- 3 references with an unsupported link type were hidden.
Vulnerability summary
CVE-2005-1111 is a medium (CVSS 4.7) Link Following vulnerability in canonical ubuntu_linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.4% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.1 (NVD)EPSS score
0.31%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 16-04-2005PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 2 agree
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Low 3.7Preferred score · NVD (NIST)
AV:L/AC:H/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 18-09-2026
18-09-202618-10-2026
EPSS score0.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Debian2 products
- cpio< 2.6-6
- debian_linuxEOL3.0 | 3.1
Redhat2 products
- cpio< 0:2.5-4.RHEL3 | < 0:2.5-8.RHEL4
- cpio-debuginfo< 0:2.5-4.RHEL3 | < 0:2.5-8.RHEL4
Canonical1 product
- ubuntu_linuxEOL4.10 | 5.04
Gnu1 product
- cpio≤ 2.6
4 vendors · 6 products
References
28 links
- lists.suse.com/archive/suse-security-announce/2006-May/0004.htmlVendor AdvisoryX Refsource SUSEBroken Link
Show all 28 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9783VDB EntrySignatureX Refsource OVALBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A358VDB EntrySignatureX Refsource OVALBroken Link
