Skip to content
OpenAdvisories
Unscored CVE-2012-5635 EUVD-2012-5519GHSA-w74w-4wpp-3vmm

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitr…

Published Apr 9, 2013 · Updated Aug 6, 2024 · Assigned by redhat

Package: glusterfs Ecosystem: Debian

Description

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 glusterfs 3.5.0-1 —
Debian 13 glusterfs 3.5.0-1 —
Debian 12 glusterfs 3.5.0-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Gluster Storage 3 glusterfs +3 3.3.0.7rhs-1.el6 RHSA-2013:0691
Red Hat Gluster Storage 2 appliance +1 1.7.1-1.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 augeas +2 0.9.0-1.el6 RHSA-2013:0691
Red Hat Gluster Storage 2 gluster-swift +5 1.4.8-5.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 glusterfs +3 3.3.0.7rhs-1.el5 RHSA-2013:0691
Red Hat Gluster Storage 2 glusterfs-server +1 3.3.0.7rhs-1.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 libvirt +4 0.9.10-21.el6_3.8 RHSA-2013:0691
Red Hat Gluster Storage 2 rhn-check +3 1.0.0-73.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 rhsc +11 2.0.techpreview1-4.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 sanlock +3 2.3-4.el6_3 RHSA-2013:0691
Red Hat Gluster Storage 2 sos 2.2-17.2.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 vdsm +8 4.9.6-20.el6rhs RHSA-2013:0691

Advisories 1

References