Augeas Multiple Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	63861
Class:	Design Error
CVE:	CVE-2012-0786 CVE-2012-0787
Remote:	No
Local:	Yes
Published:	Jul 19 2012 12:00AM
Updated:	Jan 28 2014 12:23AM
Credit:	The vendor reported these issues
Vulnerable:	Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6
Not Vulnerable:

Augeas Multiple Insecure Temporary File Creation Vulnerabilities

Augeas is prone to multiple security vulnerabilities because it creates temporary files in an insecure manner.

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks.

Successfully mounting a symlink attack may allow the attacker to corrupt sensitive files or gain access to sensitive information. Other attacks may also be possible.

Augeas 0.10.0 is vulnerable; other versions may also be affected.

Augeas Multiple Insecure Temporary File Creation Vulnerabilities

An attacker can use readily available commands to exploit these issues.

Augeas Multiple Insecure Temporary File Creation Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Augeas Multiple Insecure Temporary File Creation Vulnerabilities

References: