Description
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-836-1 cfengine2 - insecure temporary files Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-835-1 cfengine - insecure temporary files Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=107871
- 17040 third-party-advisory
- cfengine-mulitple-file-symlink(22489) vdb-entry
- 14994 vdb-entry
- DSA-836 vendor-advisory
- USN-198-1 vendor-advisory
- DSA-835 vendor-advisory
- 17182 third-party-advisory
- 17037 third-party-advisory
- http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0
- 17142 third-party-advisory
- 17038 third-party-advisory
- MDKSA-2005:184 vendor-advisory
- 17215 third-party-advisory
- SUSE-SR:2005:023 vendor-advisory