CVE-2012-5630: Race Condition
A TOCTOU (time-of-check time-of-use) race condition was found in the way libuser, a user and group account administration library, performed copying and removal of (user) directory trees. A local attacker, with permissions to write into particular directory, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of this directory (tree), if this directory was simultaneously modified (copied or removed) via libuser functionality.
This issue was found by Florian Weimer of Red Hat Product Security Team.
Other sources
libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5630?
CVE-2012-5630 is classified as a moderate severity vulnerability due to its local exploitation vector.
How do I fix CVE-2012-5630?
To fix CVE-2012-5630, upgrade libuser to the latest version provided by your operating system's package manager.
Who is affected by CVE-2012-5630?
CVE-2012-5630 affects installations of libuser version 0.57 and earlier, along with specific Debian and Fedora versions.
What kind of attack can be performed using CVE-2012-5630?
A local attacker can exploit CVE-2012-5630 to conduct symbolic link attacks, leading to unauthorized access to user directory trees.
Is CVE-2012-5630 a network-based vulnerability?
No, CVE-2012-5630 is not a network-based vulnerability; it requires local access to exploit.