FKIE_CVE-2012-4454

Vulnerability from fkie_nvd - Published: 2012-10-10 18:55 - Updated: 2026-06-16 23:45
Severity
Summary
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.
References
secalert@redhat.comhttp://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9
secalert@redhat.comhttp://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30
secalert@redhat.comhttp://secunia.com/advisories/50702Vendor Advisory
secalert@redhat.comhttp://sourceforge.net/mailarchive/message.php?msg_id=28878345
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/07/2
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/07/6
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/09/2
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/20/6
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/25/5
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/09/27/2
secalert@redhat.comhttp://www.securityfocus.com/bid/55627
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=730636
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/78797
af854a3a-2127-422b-91ae-364da2661108http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9
af854a3a-2127-422b-91ae-364da2661108http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/50702Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/mailarchive/message.php?msg_id=28878345
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/07/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/07/6
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/09/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/20/6
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/25/5
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/09/27/2
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/55627
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=730636
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/78797
Impacted products
Vendor Product Version
opencryptoki_project opencryptoki *
opencryptoki_project opencryptoki 2.2.3
opencryptoki_project opencryptoki 2.2.4
opencryptoki_project opencryptoki 2.2.4.1
opencryptoki_project opencryptoki 2.2.5
opencryptoki_project opencryptoki 2.2.6
opencryptoki_project opencryptoki 2.2.7
opencryptoki_project opencryptoki 2.2.8
opencryptoki_project opencryptoki 2.3.0
opencryptoki_project opencryptoki 2.3.1
opencryptoki_project opencryptoki 2.3.2
opencryptoki_project opencryptoki 2.3.3
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3141BA60-33AD-4301-B2BE-3E2F82AB37CA",
              "versionEndIncluding": "2.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E26F9198-85C8-41F2-AF3F-B704B85AB8A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "726C625D-9403-4CAC-9F16-9D37311A45BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DD567D-157C-4DBD-86C7-D6AC211FAFF9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9B190B6-C2F7-4CCA-9907-D899C7B1AACD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED42A7F7-9DA4-449D-9A8E-53BAEDB8BCBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "7294BF8E-62EE-404A-BC23-AE8F59B66667",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5DDE745-9CBE-4C82-A8B1-BAFFADE1ADB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A4F69A1-94EA-4B22-977D-BDCA6751D639",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDAFF947-93EA-4C3A-B84B-C1D2B41F2F97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD1FFBD7-0793-478A-AD50-64BD50848021",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6440C3E5-C1D5-49BF-8EE1-C60E3C231DBA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp."
    },
    {
      "lang": "es",
      "value": "openCryptoki anteriores a v2.4.1, cuando utiliza hilos de bucles de espera, permite a usuarios locales crear o dar permisos de escritura a todo el mundo para ficheros de su elecci\u00f3n, mediante un ataque de enlace simb\u00f3lico en los ficheros (1) .pkapi_xpk o (2) .pkcs11spinloc de /tmp."
    }
  ],
  "id": "CVE-2012-4454",
  "lastModified": "2026-06-16T23:45:07.840",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.5,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-10-10T18:55:04.440",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/50702"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28878345"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/07/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/07/6"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/09/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/20/6"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/25/5"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/27/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/55627"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=730636"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78797"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/50702"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28878345"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/07/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/07/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/09/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/20/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/25/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/09/27/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/55627"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=730636"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78797"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.