CVE-2012-2095: Input Validation
Published Apr 7, 2014
·Updated
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
Affected Software
23 affected components
David Paleino Wicd<=1.7.1
David Paleino Wicd=1.2.7
David Paleino Wicd=1.3.1
David Paleino Wicd=1.4.0
David Paleino Wicd=1.4.1
David Paleino Wicd=1.4.2
David Paleino Wicd=1.5.0
David Paleino Wicd=1.5.1
David Paleino Wicd=1.5.2
David Paleino Wicd=1.5.3
David Paleino Wicd=1.5.4
David Paleino Wicd=1.5.5
David Paleino Wicd=1.5.6
David Paleino Wicd=1.5.7
David Paleino Wicd=1.5.8
David Paleino Wicd=1.5.9
David Paleino Wicd=1.6.0
David Paleino Wicd=1.6.2
David Paleino Wicd=1.7.0
David Paleino Wicd=1.7.1-beta3
Fedoraproject Fedora=15
Fedoraproject Fedora=16
Fedoraproject Fedora=17
Event History
Apr 7, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-2095?
CVE-2012-2095 has a moderate severity as it allows local users to write arbitrary configuration settings.
2
How do I fix CVE-2012-2095?
To fix CVE-2012-2095, upgrade to WICD version 1.7.2 or later, which addresses this vulnerability.
3
What does CVE-2012-2095 affect?
CVE-2012-2095 affects local users of WICD versions prior to 1.7.2, specifically those versions listed in the advisory.
4
Can CVE-2012-2095 be exploited remotely?
No, CVE-2012-2095 can only be exploited by local users due to the nature of the vulnerability.
5
What is the impact of CVE-2012-2095?
The impact of CVE-2012-2095 is that local users can gain elevated privileges through unauthorized access to configuration settings.