Bug 887866 (CVE-2012-5660) - CVE-2012-5660 abrt: Race condition in abrt-action-install-debuginfo
Summary: CVE-2012-5660 abrt: Race condition in abrt-action-install-debuginfo
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-5660
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Martin Kyral
URL:
Whiteboard:
Depends On: 895442 895443 906280
Blocks: 887869
TreeView+ depends on / blocked
 
Reported: 2012-12-17 13:51 UTC by Jan Lieskovsky
Modified: 2023-05-11 21:49 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-19 21:58:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0215 0 normal SHIPPED_LIVE Important: abrt and libreport security update 2013-02-01 02:37:31 UTC

Description Jan Lieskovsky 2012-12-17 13:51:55 UTC 
A race condition was found in the way abrt handled the directories used to store 
information about crashes. A local attacker with the privileges of the abrt user 
could use this flaw to perform a symbolic link attack, allowing them to make any 
file writable by the abrt user, allowing them to escalate their privileges to
the privileged system user account, root.

This issue was assigned CVE-2012-5660.


Acknowledgements:

Red Hat would like to thank Martin Carpenter of Citco for reporting this issue.
Comment 6 Jan Lieskovsky 2013-01-24 15:26:50 UTC 
The preliminary embargo date for this issue has been set up to next Wednesday, 30-th January of 2013.
Comment 7 Huzaifa S. Sidhpurwala 2013-01-30 04:59:21 UTC 
Upstream patch:

http://git.fedorahosted.org/cgit/libreport.git/commit/?id=3bbf961b1884dd32654dd39b360dd78ef294b10a
Comment 8 Huzaifa S. Sidhpurwala 2013-01-30 05:00:51 UTC 
This issue affects the version of the abrt package, as shipped with Red Hat Enterprise Linux 6.

--

This issue affects the versions of the abrt package, as shipped with Fedora release of 16, 17 and 18.
Comment 9 Huzaifa S. Sidhpurwala 2013-01-31 11:02:21 UTC 
Created abrt tracking bugs for this issue

Affects: fedora-all [bug 906280]
Comment 10 errata-xmlrpc 2013-01-31 21:39:15 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0215 https://rhn.redhat.com/errata/RHSA-2013-0215.html
Note You need to log in before you can comment on or make changes to this bug.