National Cyber Awareness System

Vulnerability Summary for CVE-2012-3500

Overview

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://git.fedorahosted.org/cgit/rpmdevtools.git/commit/?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb

Type: Patch Information

Hyperlink:http://git.fedorahosted.org/cgit/rpmdevtools.git/commit/?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=848022

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=848022

External Source: XF

Name: rpmdevtools-toctou-symlink(78230)

Hyperlink:http://xforce.iss.net/xforce/xfdb/78230

External Source: UBUNTU

Name: USN-1593-1

Hyperlink:http://www.ubuntu.com/usn/USN-1593-1

External Source: BID

Name: 55358

Hyperlink:http://www.securityfocus.com/bid/55358

External Source: MLIST

Name: [oss-security] 20120831 [Notification] CVE-2012-3500 - rpmdevtools, devscripts: TOCTOU race condition in annotate-output

Hyperlink:http://www.openwall.com/lists/oss-security/2012/08/31/7

External Source: DEBIAN

Name: DSA-2549

Type: Advisory

Hyperlink:http://www.debian.org/security/2012/dsa-2549

External Source: SECUNIA

Name: 50600

Type: Advisory

Hyperlink:http://secunia.com/advisories/50600

External Source: SUSE

Name: openSUSE-SU-2012:1437

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-11/msg00000.html

External Source: FEDORA

Name: FEDORA-2012-13208

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087335.html

External Source: FEDORA

Name: FEDORA-2012-13263

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086159.html

External Source: FEDORA

Name: FEDORA-2012-13234

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086138.html

External Source: CONFIRM

Name: http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commit;h=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0

Hyperlink:http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commit;h=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0