CVE-2012-2652 - The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, whe

CVE-2012-2652

Summary

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

References

http://www.ubuntu.com/usn/USN-1522-1
http://secunia.com/advisories/50132
http://www.securityfocus.com/bid/53725
http://www.debian.org/security/2012/dsa-2545
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00024.html
http://secunia.com/advisories/50689
http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log
http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=eba25057b9a5e19d10ace2bc7716667a31297169

Vulnerable Configurations

cpe:2.3:a:qemu:qemu:1.0:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:1.0:*:*:*:*:*:*:*

CVSS

Base:	4.4 (as of 13-02-2023 - 00:25)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	53725
confirm	http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=eba25057b9a5e19d10ace2bc7716667a31297169 http://git.qemu.org/?p=qemu-stable-0.15.git;a=log
debian	DSA-2545
secunia	50132 50689
suse	SUSE-SU-2012:1202
ubuntu	USN-1522-1

Last major update

13-02-2023 - 00:25

Published

07-08-2012 - 20:55

Last modified

13-02-2023 - 00:25