Skip to content
OpenAdvisories
Unscored CVE-2012-5638 EUVD-2012-5522GHSA-48rw-xq3g-hfw6

The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwr…

Published Dec 20, 2012 · Updated Aug 6, 2024 · Assigned by redhat

Package: sanlock Ecosystem: Debian

Description

The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 sanlock 2.2-2 —
Debian 13 sanlock 2.2-2 —
Debian 12 sanlock 2.2-2 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 sanlock +3 2.3-4.el6_3 RHBA-2012:1507
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Gluster Storage 3 glusterfs +3 3.3.0.7rhs-1.el6 RHSA-2013:0691
Red Hat Gluster Storage 2 appliance +1 1.7.1-1.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 augeas +2 0.9.0-1.el6 RHSA-2013:0691
Red Hat Gluster Storage 2 gluster-swift +5 1.4.8-5.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 glusterfs +3 3.3.0.7rhs-1.el5 RHSA-2013:0691
Red Hat Gluster Storage 2 glusterfs-server +1 3.3.0.7rhs-1.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 libvirt +4 0.9.10-21.el6_3.8 RHSA-2013:0691
Red Hat Gluster Storage 2 rhn-check +3 1.0.0-73.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 rhsc +11 2.0.techpreview1-4.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 sanlock +3 2.3-4.el6_3 RHSA-2013:0691
Red Hat Gluster Storage 2 sos 2.2-17.2.el6rhs RHSA-2013:0691
Red Hat Gluster Storage 2 vdsm +8 4.9.6-20.el6rhs RHSA-2013:0691

Advisories 2

References