NVD Vulnerability Detail

CVE-2012-4453

Summary	dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
Publication Date	Oct. 10, 2012, 8:55 a.m.
Registration Date	Jan. 28, 2021, 3:03 p.m.
Last Update	Nov. 21, 2024, 10:42 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:dracut_project:dracut::::::::					024

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71
2	http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71
3	http://rhn.redhat.com/errata/RHSA-2013-1674.html	Third Party Advisory
4	http://rhn.redhat.com/errata/RHSA-2013-1674.html	Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2012/09/27/3	Mailing List Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2012/09/27/3	Mailing List Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2012/09/27/4	Mailing List Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2012/09/27/4	Mailing List Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2012/09/27/6	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2012/09/27/6	Mailing List Third Party Advisory
11	http://www.securityfocus.com/bid/55713	Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/55713	Third Party Advisory VDB Entry
13	https://bugzilla.redhat.com/show_bug.cgi?id=859448	Issue Tracking Patch Third Party Advisory
14	https://bugzilla.redhat.com/show_bug.cgi?id=859448	Issue Tracking Patch Third Party Advisory
15	https://exchange.xforce.ibmcloud.com/vulnerabilities/79258	Third Party Advisory VDB Entry
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/79258	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-276	不適切なデフォルトパーミッション	https://cwe.mitre.org/data/definitions/276.html

JVN Vulnerability Information

複数の製品で使用される dracut における重要な情報を取得される脆弱性

Title	複数の製品で使用される dracut における重要な情報を取得される脆弱性
Summary	Red Hat Enterprise Linux、Fedora、および他の製品で使用される dracut の dracut.sh には、world-readable パーミッション (誰でも読み取り可能な権限) を持つ initramfs イメージを生成するため、重要な情報を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、重要な情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 21, 2012, midnight
Registration Date	Oct. 12, 2012, 4:43 p.m.
Last Update	Oct. 12, 2012, 4:43 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux 6

Fedora Project

Fedora 16

Fedora 17

dracut Project

dracut

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-4453	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4453
National Vulnerability Database (NVD)
2	CVE-2012-4453	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4453

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Fedora Project
1	dracut-018-105.git20120927.fc17	https://admin.fedoraproject.org/updates/dracut-018-105.git20120927.fc17
2	dracut-018-60.git20120927.fc16	https://admin.fedoraproject.org/updates/dracut-018-60.git20120927.fc16
Linux Kernel
3	dracut.sh: create the initramfs non-world readable	http://git.kernel.org/?p=boot/dracut/dracut.git;a=commit;h=e1b48995c26c4f06d1a71
Red Hat Bugzilla
4	Bug 859448	https://bugzilla.redhat.com/show_bug.cgi?id=859448

Change Log

No	Changed Details	Date of change
0	[2012年10月12日] 掲載	Feb. 17, 2018, 10:37 a.m.