以下是该网页截图中关于漏洞的关键信息，以简洁的markdown格式呈现： 漏洞信息 漏洞名称: OpenServer: UnZip File Permissions Change Vulnerability CVE编号: CVE-2005-2475 CVSS Base Score: 1.2/10 Risk: Medium Local: No Remote: Yes 影响范围 Impact Subscore: 2.9/10 - Attack complexity: High - Confidentiality impact: Partial - Integrity impact: None - Availability impact: None Exploitability Subscore: 1.9/10 - Authentication: No required 问题描述 A vulnerability in unzip can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges. The vulnerability is caused due to a race condition that exists when the uncompressed file is closed and before its permissions are changed. This can be exploited via hardlink attacks to change the permissions of other files belonging to the user running unzip. Successful exploitation requires that the malicious user is able to delete the uncompressed file and replace it with a hardlink to another file owned by the unzip user, before the permissions are set on the file. 受影响的版本 OpenServer 5.0.7: unzip distribution OpenServer 6.0.0: unzip distribution 解决方案 The proper solution is to install the latest packages. 参考链接 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2475 https://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117&w=2 https://www.securityfocus.com/bid/14450 https://www.osvdb.org/18530 https://secunia.com/advisories/16309 其他资源 SCO Security Resources: https://www.sco.com/support/security/index.html SCO Security Advisories via Email: https://www.sco.com/support/forums/security.html 致谢 SCO would like to thank Imran Ghory for discovering this weakness.