CVE-2012-1106: Low severity redhat Automatic Bug Reporting Tool vulnerability
The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl fs.suiddumpable option is set to 2, which allows local users to obtain sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1106?
CVE-2012-1106 has been classified as a high severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2012-1106?
To fix CVE-2012-1106, upgrade the Automatic Bug Reporting Tool to version 2.0.8 or later where the issue is resolved.
What does CVE-2012-1106 affect?
CVE-2012-1106 affects versions of the Automatic Bug Reporting Tool prior to 2.0.8 that improperly handle GID permissions on core dump files.
Can local users exploit CVE-2012-1106?
Yes, local users can exploit CVE-2012-1106 to access sensitive information due to improper permissions on core dump files.
What is the primary cause of CVE-2012-1106?
The primary cause of CVE-2012-1106 is that the C handler plug-in in Automatic Bug Reporting Tool fails to correctly set GID permissions.