PT-2012-3084 · Red Hat+1 · Abrt+2

Publicado 2012-06-19 · Atualizado 2017-08-29 · CVE-2012-1106

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABRT versions 2.0.8 and earlier

Description The issue is related to the C handler plug-in in ABRT, which does not properly set group permissions on core dump files for setuid programs when the sysctl fs.suid dumpable option is set to 2. This allows local users to obtain sensitive information.

Recommendations For ABRT versions 2.0.8 and earlier, consider restricting access to core dump files until a proper fix is applied, to minimize the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2012_0841

CVE-2012-1106

RHSA-2012:0841

RHSA-2012_0841

Produtos afetados

Abrt

Centos

Red Hat

Referências · 16

• 🔥 https://fedorahosted.org/abrt/changeset/23d6997d7886abe118c28254f7f73f0b19b2d4e0 · Exploit
• https://lists.centos.org/pipermail/centos-announce/2012-July/080870.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1106 · Nota de Segurança
• http://securityfocus.com/bid/54121 · Nota
• https://linux.oracle.com/errata/ELSA-2012-0841.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2012-July/068183.html · Nota
• https://access.redhat.com/security/cve/CVE-2011-4088 · Nota
• https://access.redhat.com/security/cve/CVE-2012-1106 · Nota
• https://lists.centos.org/pipermail/centos-announce/2012-July/055627.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4088 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-announce/2012-July/030746.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76524 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-0841.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1106 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2012-0841.html · Nota