REDHAT-BUG-857283: Medium severity SPICE spice-client-glib-usb-acl-helper vulnerability

Published Sep 14, 2012

Updated

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application.

This flaw is similar to CVE-2012-3524

Affected Software

1 affected component

SPICE spice-client-glib-usb-acl-helper

Event History

Sep 14, 2012

Data Sourced

02:44 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-857283?

REDHAT-BUG-857283 is classified as a privilege escalation vulnerability.

How do I fix REDHAT-BUG-857283?

To mitigate REDHAT-BUG-857283, update the spice-client-glib-usb-acl-helper application to the latest version provided by your distribution.

Who is affected by REDHAT-BUG-857283?

The vulnerability REDHAT-BUG-857283 affects users of the spice-client-glib-usb-acl-helper application on systems where it is installed.

Can REDHAT-BUG-857283 be exploited remotely?

No, REDHAT-BUG-857283 requires local access to the system to be exploited.

What are the potential impacts of REDHAT-BUG-857283?

The potential impact of REDHAT-BUG-857283 includes the ability for a local attacker to escalate privileges on the affected system.