CVE-2012-5635 — LOW (2.1) — White Hats Nepal

Vulnerability Description

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.

CVSS Score

2.1

LOW

AV:L/AC:L/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Gluster	Glusterfs	-
Redhat	Storage Management Console	2.0
Redhat	Storage Native Client	-
Redhat	Storage Server	2.0

Related Weaknesses (CWE)

CWE-264

References

http://rhn.redhat.com/errata/RHSA-2013-0691.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=886364Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0691.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=886364Vendor Advisory

FAQ

What is CVE-2012-5635?

CVE-2012-5635 is a vulnerability with a CVSS score of 2.1 (LOW). The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files cr...

How severe is CVE-2012-5635?

CVE-2012-5635 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-5635?

Check the references section above for vendor advisories and patch information. Affected products include: Gluster Glusterfs, Redhat Storage Management Console, Redhat Storage Native Client, Redhat Storage Server.