Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2012-5660 abrt: Race condition in abrt-action-install-debuginfo|
|Product:||[Other] Security Response||Reporter:||Jan Lieskovsky <jlieskov>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||NEW ---||QA Contact:||Martin Kyral <mkyral>|
|Version:||unspecified||CC:||abrt-devel-list, bressers, jrusnack, mcarpenter, mkyral, security-response-team|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||895442, 895443, 906280|
Description Jan Lieskovsky 2012-12-17 08:51:55 EST
A race condition was found in the way abrt handled the directories used to store information about crashes. A local attacker with the privileges of the abrt user could use this flaw to perform a symbolic link attack, allowing them to make any file writable by the abrt user, allowing them to escalate their privileges to the privileged system user account, root. This issue was assigned CVE-2012-5660. Acknowledgements: Red Hat would like to thank Martin Carpenter of Citco for reporting this issue.
Comment 6 Jan Lieskovsky 2013-01-24 10:26:50 EST
The preliminary embargo date for this issue has been set up to next Wednesday, 30-th January of 2013.
Comment 7 Huzaifa S. Sidhpurwala 2013-01-29 23:59:21 EST
Comment 8 Huzaifa S. Sidhpurwala 2013-01-30 00:00:51 EST
This issue affects the version of the abrt package, as shipped with Red Hat Enterprise Linux 6. -- This issue affects the versions of the abrt package, as shipped with Fedora release of 16, 17 and 18.
Comment 9 Huzaifa S. Sidhpurwala 2013-01-31 06:02:21 EST
Created abrt tracking bugs for this issue Affects: fedora-all [bug 906280]