CVE-2004-2698 Race condition in n/a
Local attackers can cause a denial of service or modify arbitrary files via a symlink race condition when IMWheel runs with the -k option.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-2698?
CVE-2004-2698 is a medium-severity vulnerability in n/a, published on 6 Oct 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.
Weakness: CWE-362
Which versions are affected by CVE-2004-2698?
It affects 1 product.
Products include Imwheel Imwheel.
How do I fix CVE-2004-2698?
Upgrade to a fixed version.
Is CVE-2004-2698 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2698 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2004-2698, GHSA-64gr-p8q7-hc37.