PT-2014-2416 · Gnome · Gdm-Guest-Session

Ryan Lortie · Publicado 2014-05-22 · Atualizado 2014-07-18 · CVE-2012-6648

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gdm-guest-session versions 0.24 and earlier

Description The issue allows local users to delete arbitrary files via a space in the name of a file in /tmp. This is related to the gdm/guest-session-cleanup.sh script in gdm-guest-session.

Recommendations For gdm-guest-session versions 0.24 and earlier, consider restricting access to the /tmp directory to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using filenames with spaces in the /tmp directory.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-6648

Produtos afetados

Gdm-Guest-Session

Referências · 4

• http://ubuntu.com/usn/usn-1399-1 · Aviso do Fabricante
• https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6648 · Nota de Segurança
• https://launchpadlibrarian.net/96474113/gdm-guest-session.secure-cleanup.debdiff · Nota