CVE-2012-0863: SQL Injection
It was discovered that mumble created its database file (~/.local/share/data/Mumble/.mumble.sqlite) with insecure world-readable permissions. If the user had (non-default) permissions on their home directory, another local user could obtain password and configuration settings from the database file [1].
This has been corrected in upstream git [2] and is reported as affecting 1.2.3 and earlier.
[1] https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/783405 [2] https://github.com/mumble-voip/mumble/commit/5632c35d6759f5e13a7dfe78e4ee6403ff6a8e3e
Other sources
Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0863?
CVE-2012-0863 has a moderate severity due to the exposure of sensitive information through world-readable permissions.
How do I fix CVE-2012-0863?
To fix CVE-2012-0863, you should change the permissions of the database file to be more restrictive using the chmod command.
What versions of Mumble are affected by CVE-2012-0863?
CVE-2012-0863 affects Mumble versions up to and including 1.2.3, as well as versions 1.2.0 and 1.2.2.
What are the risks associated with CVE-2012-0863?
The risks associated with CVE-2012-0863 include unauthorized access to user passwords and configuration settings by local users.
Is there a patch available for CVE-2012-0863?
No specific patch for CVE-2012-0863 is mentioned; however, updating to a secure version of Mumble or correcting file permissions is recommended.