CVE-2012-5530 : The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before

The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.

Published 2012-11-29 13:14:38

Updated 2013-02-26 04:51:59

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2012-5530

SGI » Performance Co-pilot
Versions up to, including, (<=) 3.6.9
cpe:2.3:a:sgi:performance_co-pilot:*:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.11
cpe:2.3:a:sgi:performance_co-pilot:2.1.11:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.2
cpe:2.3:a:sgi:performance_co-pilot:2.1.2:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.9
cpe:2.3:a:sgi:performance_co-pilot:2.1.9:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.2
cpe:2.3:a:sgi:performance_co-pilot:2.2:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.3
cpe:2.3:a:sgi:performance_co-pilot:2.1.3:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.4
cpe:2.3:a:sgi:performance_co-pilot:2.1.4:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.5
cpe:2.3:a:sgi:performance_co-pilot:2.1.5:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.6
cpe:2.3:a:sgi:performance_co-pilot:2.1.6:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.1
cpe:2.3:a:sgi:performance_co-pilot:2.1.1:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.10
cpe:2.3:a:sgi:performance_co-pilot:2.1.10:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.7
cpe:2.3:a:sgi:performance_co-pilot:2.1.7:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 2.1.8
cpe:2.3:a:sgi:performance_co-pilot:2.1.8:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 3.6.6
cpe:2.3:a:sgi:performance_co-pilot:3.6.6:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 3.6.5
cpe:2.3:a:sgi:performance_co-pilot:3.6.5:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 3.6.8
cpe:2.3:a:sgi:performance_co-pilot:3.6.8:*:*:*:*:*:*:*
Matching versions
SGI » Performance Co-pilot » Version: 3.6.4
cpe:2.3:a:sgi:performance_co-pilot:3.6.4:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-5530

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-5530

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2012-5530

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-5530

http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html

[security-announce] SUSE-SU-2013:0190-1: important: Security update for

CVEs referencing this url
http://www.securityfocus.com/bid/56656

Performance Co-Pilot CVE-2012-5530 Multiple Insecure Temporary File Creation Vulnerabilities
https://bugzilla.novell.com/show_bug.cgi?id=782967

Bug 782967 – VUL-0: CVE-2012-5530: pcp: pcmd init script, insecure tmp file handling
https://bugzilla.redhat.com/show_bug.cgi?id=875842

875842 – (CVE-2012-5530) CVE-2012-5530 pcp: Insecure temporary file use flaws

Jump to

Vulnerability Details : CVE-2012-5530

Products affected by CVE-2012-5530

Exploit prediction scoring system (EPSS) score for CVE-2012-5530

CVSS scores for CVE-2012-5530

CWE ids for CVE-2012-5530

References for CVE-2012-5530