CVE-2012-5644: Infoleak
An information disclosure flaw was found in the way libuser, an user and group account administration library, performed movement of user's home directory. Previously, during the move the ownership of all the (sub)entries present in directory tree, to be moved, were changed from privileged user account to the effective user id of the user, the home directory should belong to. A local attacker could use this flaw to conduct hardlink attacks and possibly obtain unauthorized access to arbitrary system file.
This issue was found by Miloslav Trmač of Red Hat.
Other sources
libuser has information disclosure when moving user's home directory
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What security risks are associated with CVE-2012-5644?
CVE-2012-5644 presents an information disclosure risk that can lead to unauthorized access to users' home directories.
Which systems are affected by CVE-2012-5644?
CVE-2012-5644 affects versions of libuser on Debian and Red Hat Enterprise Linux systems.
How can I mitigate the CVE-2012-5644 vulnerability?
To mitigate CVE-2012-5644, ensure that you upgrade to the patched versions of libuser as specified in the advisory.
What is the impact of exploiting CVE-2012-5644?
Exploiting CVE-2012-5644 could allow attackers to gain access to sensitive information within user home directories.
Is CVE-2012-5644 a critical vulnerability?
CVE-2012-5644 is classified as a medium-severity vulnerability, but it can lead to significant data exposure if not addressed.