CVE-2012-2679 Information disclosure in n/a
Local attackers can read sensitive configuration action logs due to weak file permissions in the Red Hat Network Configuration Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2679?
CVE-2012-2679 is a low-severity vulnerability in n/a, published on 22 Oct 2012. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file.
Weakness: CWE-264
Which versions are affected by CVE-2012-2679?
It affects 1 product.
Linux distribution packages (8)
rhncfg Red Hat:rhel_rhn_tools:5 | All versions | 0:5.10.27-8.el5sat |
rhncfg-actions Red Hat:rhel_rhn_tools:5 | All versions | 0:5.10.27-8.el5sat |
rhncfg-client Red Hat:rhel_rhn_tools:5 | All versions | 0:5.10.27-8.el5sat |
rhncfg-management Red Hat:rhel_rhn_tools:5 | All versions | 0:5.10.27-8.el5sat |
rhncfg Red Hat:rhel_rhn_tools:6 | All versions | 0:5.10.27-8.el6sat |
rhncfg-actions Red Hat:rhel_rhn_tools:6 | All versions | 0:5.10.27-8.el6sat |
rhncfg-client Red Hat:rhel_rhn_tools:6 | All versions | 0:5.10.27-8.el6sat |
rhncfg-management Red Hat:rhel_rhn_tools:6 | All versions | 0:5.10.27-8.el6sat |
Products include Redhat Rhncfg.
How do I fix CVE-2012-2679?
Upgrade to a fixed version.
Is CVE-2012-2679 being exploited?
There is no known exploitation of CVE-2012-2679 in the wild and no public exploit code.
Sources
Also known as GHSA-cpqq-ch36-7c84, RHSA-2012:1369.