CVE-2005-3070 Race condition in n/a

Low 3.6 Published 27 Sep 2005 Updated 7 Aug 2024

Local attackers can exploit a race condition in HylaFax to read faxes or cause denial of service by manipulating UNIX domain socket ownership.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2005-3070?

CVE-2005-3070 is a low-severity vulnerability in n/a, published on 27 Sep 2005. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.

Which versions are affected by CVE-2005-3070?

It affects 1 product.

Products include Hylafax Hylafax.

How do I fix CVE-2005-3070?

Upgrade to a fixed version.

Is CVE-2005-3070 being exploited?

There is no known exploitation of CVE-2005-3070 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2005-3070, GHSA-5h28-cxmq-mh2v.