CVE-2012-3500

2012-10-0100:55:01

CWE-362

redhat

web.nvd.nist.gov

cve-2012-3500

scripts

annotate-output.sh

devscripts

symlink attack

nvd

security vulnerability

CVSS2

1.2

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:N/I:P/A:N

AI Score

Confidence

Low

EPSS

Percentile

10.1%

JSON

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.

Affected configurations

Nvd

Node

devscripts_devel_teamdevscriptsRange≤2.12.1

devscripts_devel_teamdevscriptsMatch2.12.0

AND

fedorarpmdevtoolsRange≤8.2-1

VendorProductVersionCPE
devscripts_devel_teamdevscripts*cpe:2.3:a:devscripts_devel_team:devscripts:*:*:*:*:*:*:*:*
devscripts_devel_teamdevscripts2.12.0cpe:2.3:a:devscripts_devel_team:devscripts:2.12.0:*:*:*:*:*:*:*
fedorarpmdevtools*cpe:2.3:a:fedora:rpmdevtools:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devscripts_devel_team	devscripts	*	cpe:2.3:a:devscripts_devel_team:devscripts::::::::
devscripts_devel_team	devscripts	2.12.0	cpe:2.3:a:devscripts_devel_team:devscripts:2.12.0:::::::*
fedora	rpmdevtools	*	cpe:2.3:a:fedora:rpmdevtools::::::::