Bug 879582 (CVE-2012-5564)

Summary:	CVE-2012-5564 android-tools (server): Insecure temporary file used for logging
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ivan.afonichev, jrusnack, misc
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-10 21:35:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	879585, 894745
Bug Blocks:

Description Jan Lieskovsky 2012-11-23 11:37:44 UTC

An insecure temporary file use flaw was found in the way server component of android tools, a suite of Android Debug Bridge (ADB) platform tools, performed logging of server events upon server startup. A local attacker could use this flaw to conduct symbolic links attacks, possibly leading to their ability to append unauthorized content to system files accessible with the privileges of the user running the adb executable.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688280

Comment 1 Jan Lieskovsky 2012-11-23 11:38:46 UTC

This issue affects the versions of the android-tools package, as shipped with Fedora release of 16 and 17. Please schedule an update (once there is final upstream patch available).

Comment 2 Jan Lieskovsky 2012-11-23 11:39:29 UTC

Created android-tools tracking bugs for this issue

Affects: fedora-all [bug 879585]

Comment 3 Jan Lieskovsky 2012-11-23 11:47:27 UTC

CVE Request:
  http://www.openwall.com/lists/oss-security/2012/11/23/1

Comment 4 Jan Lieskovsky 2012-11-27 11:10:23 UTC

The CVE identifier of CVE-2012-5564 has been assigned to this issue:
  http://www.openwall.com/lists/oss-security/2012/11/23/8