PT-2014-2416 · Gnome · Gdm-Guest-Session

Ryan Lortie · Published 2014-05-22 · Updated 2014-07-18 · CVE-2012-6648

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions gdm-guest-session versions 0.24 and earlier

Description The issue allows local users to delete arbitrary files via a space in the name of a file in /tmp. This is related to the gdm/guest-session-cleanup.sh script in gdm-guest-session.

Recommendations For gdm-guest-session versions 0.24 and earlier, consider restricting access to the /tmp directory to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using filenames with spaces in the /tmp directory.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-6648

Affected Products

Gdm-Guest-Session

References · 4

• http://ubuntu.com/usn/usn-1399-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6648 · Security Note
• https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044 · Note
• https://launchpadlibrarian.net/96474113/gdm-guest-session.secure-cleanup.debdiff · Note