CVE-2012-5660: redhat automatic_bug_reporting_tool

Vulnerability summary

CVE-2012-5660 is a medium (CVSS 6.9) vulnerability in redhat automatic_bug_reporting_tool. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-03-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.