CVE-2012-4454 openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file...
LowCVSS 2.9
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/opencryptoki(Debian:12) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| debian/opencryptoki(Debian:13) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| debian/opencryptoki(Debian:14) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| opencryptoki project opencryptoki | <= 2.4 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.3 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.4 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.4.1 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.5 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.6 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.7 | No fix listed |
| opencryptoki project opencryptoki | = 2.2.8 | No fix listed |
| opencryptoki project opencryptoki | = 2.3.0 | No fix listed |
| opencryptoki project opencryptoki | = 2.3.1 | No fix listed |
| opencryptoki project opencryptoki | = 2.3.2 | No fix listed |
| opencryptoki project opencryptoki | = 2.3.3 | No fix listed |
References
- Debian Security Tracker CVE-2012-4454 vendor-advisory
- opencryptoki.git.sourceforge.net
- opencryptoki.git.sourceforge.net
- 50702 third-party-advisory vendor-advisory
- [Opencryptoki-tech] 20120223 opencryptoki version 2.4.1 released mailing-list
- [oss-security] 20120906 CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120907 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120909 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120920 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120924 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120927 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- 55627 vdb-entry
- bugzilla.redhat.com
- opencryptoki-mutliple-symlink(78797) vdb-entry
- bugs.debian.org issue-tracking