PT-2012-4764 · Debian+1 · Devscripts+1

Jan Lieskovsky + 1 · Published 2012-10-01 · Updated 2024-06-15 · CVE-2012-3500

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions devscripts versions prior to 2.12.2 rpmdevtools versions prior to 8.3

Description The issue allows local users to modify arbitrary files via a symlink attack on the temporary standard output or standard error output file. This is related to the scripts/annotate-output.sh script in devscripts.

Recommendations For devscripts versions prior to 2.12.2, update to version 2.12.2 or later. For rpmdevtools versions prior to 8.3, update to version 8.3 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2012-3500

DSA-2549-1

OPENSUSE-SU-2024:10372-1

OPENSUSE-SU-2024:11306-1

Affected Products

Devscripts

Rpmdevtools

References · 21

• http://ubuntu.com/usn/USN-1593-1 · Vendor Advisory
• http://debian.org/security/2012/dsa-2549 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086138.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-11/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3500 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:123 · Vendor Advisory
• http://secunia.com/advisories/50600 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3500 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3500 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087335.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086159.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11306-1 · Vendor Advisory
• http://git.fedorahosted.org/cgit/rpmdevtools.git/commit/?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb · Patch
• https://security-tracker.debian.org/tracker/CVE-2012-3500 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/08/31/7 · Note