CVE-2012-5635

2013-04-0920:55:01

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-5635

glusterfs

red hat storage management console

symlink attack

file overwrite

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.

Affected configurations

NVD

Node

glusterglusterfsMatch-

redhatstorage_management_consoleMatch2.0

redhatstorage_native_clientMatch-

redhatstorage_serverMatch2.0

CPENameOperatorVersion
gluster:glusterfsgluster glusterfseq-
redhat:storage_management_consoleredhat storage management consoleeq2.0
redhat:storage_native_clientredhat storage native clienteq-
redhat:storage_serverredhat storage servereq2.0

CPE	Name	Operator	Version
gluster:glusterfs	gluster glusterfs	eq	-
redhat:storage_management_console	redhat storage management console	eq	2.0
redhat:storage_native_client	redhat storage native client	eq	-
redhat:storage_server	redhat storage server	eq	2.0