Bug 879582 (CVE-2012-5564)

Summary: CVE-2012-5564 android-tools (server): Insecure temporary file used for logging
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ivan.afonichev, jrusnack, misc
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-10 21:35:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 879585, 894745    
Bug Blocks:    

Description Jan Lieskovsky 2012-11-23 11:37:44 UTC
An insecure temporary file use flaw was found in the way server component of android tools, a suite of Android Debug Bridge (ADB) platform tools, performed logging of server events upon server startup. A local attacker could use this flaw to conduct symbolic links attacks, possibly leading to their ability to append unauthorized content to system files accessible with the privileges of the user running the adb executable.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688280

Comment 1 Jan Lieskovsky 2012-11-23 11:38:46 UTC
This issue affects the versions of the android-tools package, as shipped with Fedora release of 16 and 17. Please schedule an update (once there is final upstream patch available).

Comment 2 Jan Lieskovsky 2012-11-23 11:39:29 UTC
Created android-tools tracking bugs for this issue

Affects: fedora-all [bug 879585]

Comment 3 Jan Lieskovsky 2012-11-23 11:47:27 UTC
CVE Request:

Comment 4 Jan Lieskovsky 2012-11-27 11:10:23 UTC
The CVE identifier of CVE-2012-5564 has been assigned to this issue: