CVE-2012-3500: Race Condition
A TOCTOU race condition was found in the way 'annotate-output' (used to execute a program annotating the output linewise with time and stream) tool of rpmdevtools, a suite of scripts and (X)Emacs support files to aid in development of RPM packages, performed management of its temporary files used for standard output and standard error output. A local attacker could use this flaw to conduct symbolic link attacks, possibly leading to their ability in an unauthorized way to alter files belonging to the user running the 'annotate-output' tool.
Issue found by Jim Meyering of Red Hat.
Other sources
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3500?
CVE-2012-3500 is classified as a medium severity vulnerability due to its potential to exploit a race condition.
How do I fix CVE-2012-3500?
To fix CVE-2012-3500, users should update to versions of devscripts or rpmdevtools that are patched for this vulnerability.
What type of vulnerability is CVE-2012-3500?
CVE-2012-3500 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability.
Which versions of devscripts are affected by CVE-2012-3500?
CVE-2012-3500 affects devscripts versions up to and including 2.12.1 and specifically version 2.12.0.
Which software is impacted by CVE-2012-3500?
CVE-2012-3500 impacts Debian devscripts and Fedora RPM devtools.