CVE-2005-2725 Missing authorization in n/a
Local attackers can read arbitrary files via the inputtrap utility due to improper permission checks when using the -t flag.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-2725?
CVE-2005-2725 is a low-severity missing authorization vulnerability in n/a, published on 29 Aug 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The inputtrap utility in QNX RTOS 6.1.0, 6.3, and possibly earlier versions does not properly check permissions when the -t flag is specified, which allows local users to read arbitrary files.
Which versions are affected by CVE-2005-2725?
It affects 1 product.
Products include Qnx Rtos.
How do I fix CVE-2005-2725?
No fix has been published for CVE-2005-2725 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2005-2725 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-2725 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hvv7-rwc6-4777.