CVE-2012-4455 openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/...
MediumCVSS 6.2
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/opencryptoki(Debian:12) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| debian/opencryptoki(Debian:13) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| debian/opencryptoki(Debian:14) | < 3.4.1+dfsg-1 | 3.4.1+dfsg-1 |
| opencryptoki project opencryptoki | = 2.4.1 | No fix listed |
References
- Debian Security Tracker CVE-2012-4455 vendor-advisory
- opencryptoki.git.sourceforge.net
- 50702 third-party-advisory vendor-advisory
- [Opencryptoki-tech] 20120427 opencryptoki release 2.4.2 mailing-list
- [oss-security] 20120906 CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120907 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120909 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120920 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120924 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- [oss-security] 20120927 Re: CVE request: opencryptoki insecure lock files handling mailing-list
- 55627 vdb-entry
- bugzilla.redhat.com
- opencryptoki-file-symlink(78943) vdb-entry
- bugs.debian.org issue-tracking