The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.

The remote NewStart CGSL host, running version MAIN 6.01, has pcp packages installed that are affected by multiple vulnerabilities:

  - libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows     remote attackers to cause a denial of service and     possibly execute arbitrary code via (1) a PDU with the     numcreds field value greater than the number of actual     elements to the __pmDecodeCreds function in p_creds.c;
    (2) the string byte number value to the
    __pmDecodeNameList function in p_pmns.c; (3) the numids     value to the __pmDecodeIDList function in p_pmns.c; (4)     unspecified vectors to the __pmDecodeProfile function in     p_profile.c; the (5) status number value or (6) string     number value to the __pmDecodeNameList function in     p_pmns.c; (7) certain input to the __pmDecodeResult     function in p_result.c; (8) the name length field     (namelen) to the DecodeNameReq function in p_pmns.c; (9)     a crafted PDU_FETCH request to the __pmDecodeFetch     function in p_fetch.c; (10) the namelen field in the
    __pmDecodeInstanceReq function in p_instance.c; (11) the     buflen field to the __pmDecodeText function in p_text.c;
    (12) PDU_INSTANCE packets to the __pmDecodeInstance in     p_instance.c; or the (13) c_numpmid or (14) v_numval     fields to the __pmDecodeLogControl function in     p_lcontrol.c, which triggers integer overflows, heap-     based buffer overflows, and/or buffer over-reads.
    (CVE-2012-3418)

  - Performance Co-Pilot (PCP) before 3.6.5 exports some of     the /proc file system, which allows attackers to obtain     sensitive information such as proc/pid/maps and command     line arguments. (CVE-2012-3419)

  - Multiple memory leaks in Performance Co-Pilot (PCP)     before 3.6.5 allow remote attackers to cause a denial of     service (memory consumption or daemon crash) via a large     number of PDUs with (1) a crafted context number to the     DoFetch function in pmcd/src/dofetch.c or (2) a negative     type value to the __pmGetPDU function in     libpcp/src/pdu.c. (CVE-2012-3420)

  - The pduread function in pdu.c in libpcp in Performance     Co-Pilot (PCP) before 3.6.5 does not properly time out     connections, which allows remote attackers to cause a     denial of service (pmcd hang) by sending individual     bytes of a PDU separately, related to an event-driven     programming flaw. (CVE-2012-3421)

  - The (1) pcmd and (2) pmlogger init scripts in     Performance Co-Pilot (PCP) before 3.6.10 allow local     users to overwrite arbitrary files via a symlink attack     on a /var/tmp/##### temporary file. (CVE-2012-5530)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

pcp was updated to version 3.6.10 which fixes security issues and also brings a lot of new features.

  - Update to pcp-3.6.10.

  - Transition daemons to run under an unprivileged account.

  - Fixes for security advisory CVE-2012-5530: tmpfile     flaws;. (bnc#782967)

  - Fix pcp(1) command short-form pmlogger reporting.

  - Fix pmdalogger error handling for directory files.

  - Fix pmstat handling of odd corner case in CPU metrics.

  - Correct the python ctype used for pmAtomValue 32bit     ints.

  - Add missing RPM spec dependency for python-ctypes.

  - Corrections to pmdamysql metrics units.

  - Add pmdamysql slave status metrics.

  - Improve pmcollectl error messages.

  - Parameterize pmcollectl CPU counts in interrupt subsys.

  - Fix generic RPM packaging for powerpc builds.

  - Fix python API use of reentrant libpcp string routines.

  - Python code backporting for RHEL5 in qa and pmcollectl.

  - Fix edge cases in capturing interrupt error counts.

  - Update to pcp-3.6.9.

  - Python wrapper for the pmimport API

  - Make sar2pcp work with the sysstat versions from RHEL5,     RHEL6, and all recent Fedora versions (which is almost     all current versions of sysstat verified).

  - Added a number of additional metrics into the importer     for people starting to use it to analyse sar data from     real customer incidents.

  - Rework use of C99 'restrict' keyword in pmdalogger     (Debian bug: 689552)

  - Alot of work on the PCP QA suite, special thanks to     Tomas Dohnalek for all his efforts there.

  - Win32 build updates

  - Add 'raw' disk active metrics so that existing tools     like iostat can be emulated

  - Allow sar2pcp to accept XML input directly (.xml     suffix), allowing it to not have to run on the same     platform as the sadc/sadf that originally generated it.

  - Add PMI error codes into the PCP::LogImport perl module.

  - Fix a typo in pmiUnits man page synopsis section

  - Resolve pmdalinux ordering issue in NUMA/CPU indom setup     (Redhat bug: 858384)

  - Remove unused pmcollectl imports (Redhat bug: 863210)

  - Allow event traces to be used in libpcp interpolate mode

  - Update to pcp-3.6.8.

  - Corrects the disk/partition identification for the MMC     driver, which makes disk indom handling correct on the     Raspberry Pi (http://www.raspberrypi.org/)

  - Several minor/basic fixes for pmdaoracle.

  - Improve pmcollectl compatibility.

  - Make a few clarifications to pmcollectl.1.

  - Improve python API test coverage.

  - Numerous updates to the test suite in general.

  - Allow pmda Install scripts to specify own dso name     again.

  - Reconcile spec file differences between PCP flavours.

  - Fix handling of multiple contexts with a remote     namespace.

  - Core socket interface abstractions to support NSS     (later).

  - Fix man page SYNOPSIS section for pmUnpackEventRecords.

  - Add --disable-shared build option for static builds.

  - Update to pcp-3.6.6.

  - Added the python PMAPI bindings and an initial python     client in pmcollectl. Separate, new package exists for     python libs for those platforms that split out packages     (rpm, deb).

  - Added a pcp-testsuite package for those platforms that     might want this (rpm, deb again, mainly)

  - Re-introduced the pcp/qa subdirectory in pcp and     deprecated the external pcpqa git tree.

  - Fix potential buffer overflow in pmlogger host name     handling.

  - Reworked the configure --prefix handling to be more like     the rest of the open source world.

  - Ensure the __pmDecodeText ident parameter is always set     Resolves Red Hat bugzilla bug #841306.

pcp was updated to version 3.6.10 which fixes security issues and also brings a lot of new features.

  - Update to pcp-3.6.10. o Transition daemons to run under     an unprivileged account. o Fixes for security advisory     CVE-2012-5530: tmpfile flaws; (bnc#782967). o Fix pcp(1)     command short-form pmlogger reporting. o Fix pmdalogger     error handling for directory files. o Fix pmstat     handling of odd corner case in CPU metrics. o Correct     the python ctype used for pmAtomValue 32bit ints. o Add     missing RPM spec dependency for python-ctypes. o     Corrections to pmdamysql metrics units. o Add pmdamysql     slave status metrics. o Improve pmcollectl error     messages. o Parameterize pmcollectl CPU counts in     interrupt subsys. o Fix generic RPM packaging for     powerpc builds. o Fix python API use of reentrant libpcp     string routines. o Python code backporting for RHEL5 in     qa and pmcollectl. o Fix edge cases in capturing     interrupt error counts.

  - Update to pcp-3.6.9. o Python wrapper for the pmimport     API o Make sar2pcp work with the sysstat versions from     RHEL5, RHEL6, and all recent Fedora versions (which is     almost all current versions of sysstat verified). o     Added a number of additional metrics into the importer     for people starting to use it to analyse sar data from     real customer incidents. o Rework use of C99 'restrict'     keyword in pmdalogger (Debian bug: 689552) o Alot of     work on the PCP QA suite, special thanks to Tomas     Dohnalek for all his efforts there. o Win32 build     updates o Add 'raw' disk active metrics so that existing     tools like iostat can be emulated o Allow sar2pcp to     accept XML input directly (.xml suffix), allowing it to     not have to run on the same platform as the sadc/sadf     that originally generated it. o Add PMI error codes into     the PCP::LogImport perl module. o Fix a typo in pmiUnits     man page synopsis section o Resolve pmdalinux ordering     issue in NUMA/CPU indom setup (Redhat bug: 858384) o     Remove unused pmcollectl imports (Redhat bug: 863210) o     Allow event traces to be used in libpcp interpolate mode

  - Update to pcp-3.6.8. o Corrects the disk/partition     identification for the MMC driver, which makes disk     indom handling correct on the Raspberry Pi     (http://www.raspberrypi.org/) o Several minor/basic     fixes for pmdaoracle. o Improve pmcollectl     compatibility. o Make a few clarifications to     pmcollectl.1. o Improve python API test coverage. o     Numerous updates to the test suite in general. o Allow     pmda Install scripts to specify own dso name again. o     Reconcile spec file differences between PCP flavours. o     Fix handling of multiple contexts with a remote     namespace. o Core socket interface abstractions to     support NSS (later). o Fix man page SYNOPSIS section for     pmUnpackEventRecords. o Add --disable-shared build     option for static builds.

  - Update to pcp-3.6.6. o Added the python PMAPI bindings     and an initial python client in pmcollectl. Separate,     new package exists for python libs for those platforms     that split out packages (rpm, deb). o Added a     pcp-testsuite package for those platforms that might     want this (rpm, deb again, mainly) o Re-introduced the     pcp/qa subdirectory in pcp and deprecated the external     pcpqa git tree. o Fix potential buffer overflow in     pmlogger host name handling. o Reworked the configure
    --prefix handling to be more like the rest of the open     source world. o Ensure the __pmDecodeText ident     parameter is always set Resolves Red Hat bugzilla bug     #841306.

Resolve insecure temporary file use flaws in PCP shell scripts

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
138771	NewStart CGSL MAIN 6.01 : pcp Multiple Vulnerabilities (NS-SA-2020-0032)	Nessus	NewStart CGSL Local Security Checks	medium
64188	SuSE 11.2 Security Update : pcp (SAT Patch Number 7221)	Nessus	SuSE Local Security Checks	medium
63680	SuSE 10 Security Update : pcp (ZYPP Patch Number 8421)	Nessus	SuSE Local Security Checks	medium
63047	Fedora 18 : pcp-3.6.10-1.fc18 (2012-18587)	Nessus	Fedora Local Security Checks	low
63014	Fedora 17 : pcp-3.6.10-1.fc17 (2012-18686)	Nessus	Fedora Local Security Checks	low
63011	Fedora 16 : pcp-3.6.10-1.fc16 (2012-18654)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-5530

critical

Tenable Plugins

medium

medium

medium

low

low

low