← Vulnerability feed

Vulnerability record · CVE-2005-3137 · published 5 October 2005

CVE-2005-3137: Gnu cfengine vulnerability

Gnu · Cfengine

The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.

2.1 CVSS 2.0 Low EPSS 0.43% · top 65.5%
2.1CVSS 2.0 base score
0.43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
26References
16 Jun 2026Last modified by NVD

Description

The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.

AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugs.gentoo.org/show_bug.cgi?id=107871
http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0
http://secunia.com/advisories/17037/ Vendor Advisory
http://secunia.com/advisories/17038
http://secunia.com/advisories/17040
http://secunia.com/advisories/17142
http://secunia.com/advisories/17182
http://www.debian.org/security/2005/dsa-835 PatchVendor Advisory
http://www.debian.org/security/2005/dsa-836 PatchVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:184
http://www.securityfocus.com/bid/14994
http://www.ubuntu.com/usn/usn-198-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/22489
http://bugs.gentoo.org/show_bug.cgi?id=107871
http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0
http://secunia.com/advisories/17037/ Vendor Advisory
http://secunia.com/advisories/17038
http://secunia.com/advisories/17040
http://secunia.com/advisories/17142
http://secunia.com/advisories/17182
http://www.debian.org/security/2005/dsa-835 PatchVendor Advisory
http://www.debian.org/security/2005/dsa-836 PatchVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:184
http://www.securityfocus.com/bid/14994
http://www.ubuntu.com/usn/usn-198-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/22489

Track CVE-2005-3137 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-1701Gnu cfengine vulnerabilityHeap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitra…EPSS 20%10.0CVE-2000-0947Gnu cfengine vulnerabilityFormat string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the…EPSS 2.5%7.5CVE-2003-0849Gnu cfengine vulnerabilityBuffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length val…EPSS 11%5.0CVE-2004-1702Gnu cfengine vulnerabilityThe AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction funct…EPSS 2.4%2.1CVE-2005-2960Gnu cfengine vulnerabilitycfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulner…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2005-3137), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.