Unscored CVE-2012-3504 EUVD-2012-3459GHSA-x8cv-g59m-9p6q

The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on t…

Published Oct 10, 2012 · Updated Aug 6, 2024 · Assigned by redhat

Description

The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on the "list" file in the current working directory.

References

[oss-security] 20121002 CVE-2012-3504: insecure temporary file usage in genkey perl script mailing-list
55756 vdb-entry
https://bugzilla.redhat.com/show_bug.cgi?id=849256
cryptoutils-genkey-symlink(79016) vdb-entry