PT-2012-4736 · Gnome · Gnome Keyring

Julien Cristau · Published 2012-10-22 · Updated 2013-12-05 · CVE-2012-3466

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNOME gnome-keyring versions 3.4.0 through 3.4.1

Description The issue is related to the caching of passphrases in GNOME gnome-keyring. When the gpg-cache-method is set to "idle" or "timeout", the software does not properly limit the amount of time a passphrase is cached. This could allow attackers to have an unspecified impact, although the exact attack vectors are not specified.

Recommendations For versions 3.4.0 through 3.4.1, consider changing the gpg-cache-method setting to a more secure option to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3466

OPENSUSE-SU-2024:10560-1

Affected Products

Gnome Keyring

References · 13

• 🔥 https://bugzilla.gnome.org/show_bug.cgi?id=681081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3466 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3466 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3466 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00037.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3466 · Vendor Advisory
• http://git.gnome.org/browse/gnome-keyring/commit/?id=5dff623470b859e332dbe12afb0dc57b292832d2 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=845426 · Note
• http://openwall.com/lists/oss-security/2012/08/09/2 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683655 · Note
• http://openwall.com/lists/oss-security/2012/08/09/1 · Note
• http://git.gnome.org/browse/gnome-keyring/commit/?id=51606f299e5ee9d48096db0a5957efe26cbf7cc3 · Note