CVE-2012-5355

2012-10-1018:55:05

CWE-59

[email protected]

web.nvd.nist.gov

cve-2012-5355

xdiagnose

local users

symlink attack

temporary file

nvd

3.3 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

Affected configurations

NVD

Node

bryce_harringtonxdiagnoseRange≤2.5

bryce_harringtonxdiagnoseMatch0.2-0ubuntu2

bryce_harringtonxdiagnoseMatch1.6

bryce_harringtonxdiagnoseMatch1.6.1

CPENameOperatorVersion
bryce_harrington:xdiagnosebryce harrington xdiagnosele2.5
bryce_harrington:xdiagnosebryce harrington xdiagnoseeq0.2-0ubuntu2
bryce_harrington:xdiagnosebryce harrington xdiagnoseeq1.6
bryce_harrington:xdiagnosebryce harrington xdiagnoseeq1.6.1

CPE	Name	Operator	Version
bryce_harrington:xdiagnose	bryce harrington xdiagnose	le	2.5
bryce_harrington:xdiagnose	bryce harrington xdiagnose	eq	0.2-0ubuntu2
bryce_harrington:xdiagnose	bryce harrington xdiagnose	eq	1.6
bryce_harrington:xdiagnose	bryce harrington xdiagnose	eq	1.6.1