CVE-2012-1586 Information disclosure in n/a
Local attackers can determine the existence of arbitrary files or directories via error messages in mount.cifs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-1586?
CVE-2012-1586 is a low-severity vulnerability in n/a, published on 27 Aug 2012. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.
Weakness: CWE-200
Which versions are affected by CVE-2012-1586?
It affects 1 product.
Linux distribution packages (8)
cifs-utils Red Hat:enterprise_linux:6::client | All versions | 0:4.8.1-10.el6 |
cifs-utils-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:4.8.1-10.el6 |
cifs-utils Red Hat:enterprise_linux:6::computenode | All versions | 0:4.8.1-10.el6 |
cifs-utils-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:4.8.1-10.el6 |
cifs-utils Red Hat:enterprise_linux:6::server | All versions | 0:4.8.1-10.el6 |
cifs-utils-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:4.8.1-10.el6 |
cifs-utils Red Hat:enterprise_linux:6::workstation | All versions | 0:4.8.1-10.el6 |
cifs-utils-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:4.8.1-10.el6 |
Products include Debian Cifs-Utils.
How do I fix CVE-2012-1586?
Apply the vendor's patch.
Is CVE-2012-1586 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-1586 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2012-1586, GHSA-pm5w-chj8-22cj, RHSA-2012:0902.