CVE-2012-5635

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-5635
The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2013-0691.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=886364 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gluster:glusterfs:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_management_console:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_native_client:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_server:2.0:*:*:*:*:*:*:*
History

13 Feb 2023, 04:37

Type Values Removed Values Added
Summary Multiple insecure temporary file creation flaws were found in Red Hat Storage. A local user on the Red Hat Storage server could use these flaws to cause arbitrary files to be overwritten as the root user via a symbolic link attack. The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0691', 'name': 'https://access.redhat.com/errata/RHSA-2013:0691', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2012-5635', 'name': 'https://access.redhat.com/security/cve/CVE-2012-5635', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 16:15

Type Values Removed Values Added
Summary The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417. Multiple insecure temporary file creation flaws were found in Red Hat Storage. A local user on the Red Hat Storage server could use these flaws to cause arbitrary files to be overwritten as the root user via a symbolic link attack.
References
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0691 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2012-5635 -
Information

Published : 2013-04-09 20:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-5635

Mitre link : CVE-2012-5635

CVE.ORG link : CVE-2012-5635

JSON object : View

Products Affected

gluster

  • glusterfs

redhat

  • storage_native_client
  • storage_server
  • storage_management_console
CWE
CWE-264

Permissions, Privileges, and Access Controls