PT-2013-1558 · Emc · Emc Avamar Plugin For Oracle+1

Published 2013-01-21 · Updated 2013-01-22 · CVE-2012-2291

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Avamar Client versions 4.x through 6.x EMC Avamar plugin versions 4.x through 6.x for Oracle

Description The issue allows local users to gain privileges via an unspecified symlink attack due to world-writable permissions for cache directories.

Recommendations For EMC Avamar Client versions 4.x through 6.x, consider changing the permissions of the cache directories to prevent world-writable access until a patch is available. For EMC Avamar plugin versions 4.x through 6.x for Oracle, restrict access to the cache directories to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2291

Affected Products

Emc Avamar Client

Emc Avamar Plugin For Oracle

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2012-2291 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html · Note