PT-2021-8362 · Google · Golang

Ludwig Nussel · Published 2021-07-09 · Updated 2021-10-18 · CVE-2012-2666

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions golang/go versions prior to 1.0.2

Description The issue arises from the dotest() function in src/pkg/debug/gosym/pclntab test.go, which creates a temporary file with a predictable name and executes it as a shell script. This behavior poses a risk, especially on shared machines.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the dotest() function in src/pkg/debug/gosym/pclntab test.go until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2012-2666

Affected Products

Golang

References · 7

• 🔥 https://codereview.appspot.com/5992078 · Exploit
• https://github.com/golang/go/commit/8ac275bb01588a8c0e6c0fe2de7fd11f08feccdd · Patch
• https://bugzilla.suse.com/show_bug.cgi?id=765455 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-2666 · Security Note
• https://whitesourcesoftware.com/vulnerability-database/CVE-2012-2666 · Note
• https://security.netapp.com/advisory/ntap-20210902-0009 · Note
• https://t.me/cvenotify/20551 · Telegram Post