CVE-2012-5660

2013-03-1223:55:01

CWE-362

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-5660

abrt

automatic bug reporting tool

symlink attack

world-writable permissions

crash information

privilege escalation

nvd

6.1 Medium

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.2%

JSON

abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on “the directories used to store information about crashes.”

Affected configurations

NVD

Node

redhatautomatic_bug_reporting_toolRange≤2.0.9

redhatautomatic_bug_reporting_toolMatch2.0.0

redhatautomatic_bug_reporting_toolMatch2.0.1

redhatautomatic_bug_reporting_toolMatch2.0.2

redhatautomatic_bug_reporting_toolMatch2.0.3

redhatautomatic_bug_reporting_toolMatch2.0.4

redhatautomatic_bug_reporting_toolMatch2.0.4.980

redhatautomatic_bug_reporting_toolMatch2.0.4.981

redhatautomatic_bug_reporting_toolMatch2.0.5

redhatautomatic_bug_reporting_toolMatch2.0.6

redhatautomatic_bug_reporting_toolMatch2.0.7

redhatautomatic_bug_reporting_toolMatch2.0.8

CPENameOperatorVersion
redhat:automatic_bug_reporting_toolredhat automatic bug reporting toolle2.0.9
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.0
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.1
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.2
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.3
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.4
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.4.980
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.4.981
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.5
redhat:automatic_bug_reporting_toolredhat automatic bug reporting tooleq2.0.6

CPE	Name	Operator	Version
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	le	2.0.9
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.0
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.1
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.2
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.3
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.4
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.4.980
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.4.981
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.5
redhat:automatic_bug_reporting_tool	redhat automatic bug reporting tool	eq	2.0.6