CVE-2005-4352
The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value (19 Jan 2038), which…
Does this matter?
Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.
Description
The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restrictions and set the clock backwards by setting the clock ahead to the maximum unixtime value (19 Jan 2038), which then wraps around to the minimum value (13 Dec 1901), which can then be set ahead to the desired time, aka "settimeofday() time wrap."
- CVSS 2.0
- 2.1 LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 0.47% probability · 39th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel · netbsd/netbsd
- Source
- cve@mitre.org
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041178.htmlExploit, Vendor Advisory
- http://secunia.com/advisories/25691
- http://securitytracker.com/id?1015454
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-16.txtExploit, Vendor Advisory
- http://www.securityfocus.com/archive/1/421426/100/0/threaded
- http://www.securityfocus.com/archive/1/471457
- http://www.securityfocus.com/bid/16170Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24036
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041178.htmlExploit, Vendor Advisory
- http://secunia.com/advisories/25691
- http://securitytracker.com/id?1015454
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-16.txtExploit, Vendor Advisory
- http://www.securityfocus.com/archive/1/421426/100/0/threaded
- http://www.securityfocus.com/archive/1/471457
- http://www.securityfocus.com/bid/16170Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24036
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.