scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.

- Fix tmp issues in annotate-output (bnc#778291,     CVE-2012-3500)

Updated rpmdevtools package fixes security vulnerability :

A TOCTOU race condition was found in the way 'annotate-output' (used to execute a program annotating the output linewise with time and stream) tool of rpmdevtools before 8.3 performed management of its temporary files used for standard output and standard error output. A local attacker could use this flaw to conduct symbolic link attacks, possibly leading to their ability in an unauthorized way to alter files belonging to the user running the 'annotate-output' tool (CVE-2012-3500).

Raphael Geissert discovered that the debdiff.pl tool incorrectly handled shell metacharacters. If a user or automated system were tricked into processing a specially crafted filename, a remote attacker could possibly execute arbitrary code. (CVE-2012-0212)

Raphael Geissert discovered that the dscverify tool incorrectly escaped arguments to external commands. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly execute arbitrary code. (CVE-2012-2240)

Raphael Geissert discovered that the dget tool incorrectly performed input validation. If a user or automated system were tricked into processing specially crafted files, a remote attacker could delete arbitrary files. (CVE-2012-2241)

Raphael Geissert discovered that the dget tool incorrectly escaped arguments to external commands. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2242)

Jim Meyering discovered that the annotate-output tool incorrectly handled temporary files. A local attacker could use this flaw to alter files being processed by the annotate-output tool. On Ubuntu 11.04 and later, this issue was mitigated by the Yama kernel symlink restrictions. (CVE-2012-3500).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream version 8.3, fixing among other issues a symlink attack possibility in annotate-output (CVE-2012-3500).

http://git.fedorahosted.org/cgit/rpmdevtools.git/tree/NEWS?id=HEAD

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in devscripts, a set of scripts to make the life of a Debian Package maintainer easier. The following Common Vulnerabilities and Exposures project ids have been assigned to identify them :

  - CVE-2012-2240 :
    Raphael Geissert discovered that dscverify does not     perform sufficient validation and does not properly     escape arguments to external commands, allowing a remote     attacker (as when dscverify is used by dget) to execute     arbitrary code.

  - CVE-2012-2241 :
    Raphael Geissert discovered that dget allows an attacker     to delete arbitrary files when processing a specially     crafted .dsc or .changes file, due to insuficient input     validation.

  - CVE-2012-2242 :
    Raphael Geissert discovered that dget does not properly     escape arguments to external commands when processing     .dsc and .changes files, allowing an attacker to execute     arbitrary code. This issue is limited with the fix for     CVE-2012-2241, and had already been fixed in version     2.10.73 due to changes to the code, without considering     its security implications.

  - CVE-2012-3500 :
    Jim Meyering, Red Hat, discovered that annotate-output     determines the name of temporary named pipes in a way     that allows a local attacker to make it abort, leading     to denial of service.

Additionally, a regression in the exit code of debdiff introduced in DSA-2409-1 has been fixed.

ID	Name	Product	Family	Severity
74802	openSUSE Security Update : deb / update-alternatives (openSUSE-SU-2012:1437-1)	Nessus	SuSE Local Security Checks	low
66135	Mandriva Linux Security Advisory : rpmdevtools (MDVSA-2013:123)	Nessus	Mandriva Local Security Checks	low
62411	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : devscripts vulnerabilities (USN-1593-1)	Nessus	Ubuntu Local Security Checks	high
62145	Fedora 18 : rpmdevtools-8.3-1.fc18 (2012-13208)	Nessus	Fedora Local Security Checks	low
62113	Debian DSA-2549-1 : devscripts - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
62053	Fedora 16 : rpmdevtools-8.3-1.fc16 (2012-13263)	Nessus	Fedora Local Security Checks	low
62051	Fedora 17 : rpmdevtools-8.3-1.fc17 (2012-13234)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-3500

medium

Tenable Plugins

low

low

high

low

high

low

low