CVE-2012-5660: Race Condition
A race condition was found in the way abrt handled the directories used to store information about crashes. A local attacker with the privileges of the abrt user could use this flaw to perform a symbolic link attack, allowing them to make any file writable by the abrt user, allowing them to escalate their privileges to the privileged system user account, root.
This issue was assigned CVE-2012-5660.
Acknowledgements:
Red Hat would like to thank Martin Carpenter of Citco for reporting this issue.
Other sources
abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5660?
CVE-2012-5660 is classified as a moderate severity vulnerability.
How do I fix CVE-2012-5660?
To fix CVE-2012-5660, update the Red Hat Automatic Bug Reporting Tool to version 2.0.9 or later.
Who is affected by CVE-2012-5660?
CVE-2012-5660 affects local users with the privileges of the abrt user on systems running the specified versions of the Red Hat Automatic Bug Reporting Tool.
What type of attack does CVE-2012-5660 allow?
CVE-2012-5660 allows a symbolic link attack, enabling a local attacker to manipulate files writable by the abrt user.
When was CVE-2012-5660 disclosed?
CVE-2012-5660 was disclosed in 2012.