A vulnerability classified as problematic was found in libuser 0.58-3.fc18. This vulnerability affects an unknown function of the component Home Directory Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

libuser has information disclosure when moving user's home directory

The weakness was presented 11/25/2019 (Website). The advisory is shared for download at access.redhat.com. This vulnerability was named CVE-2012-5644 since 10/24/2012. The attack needs to be approached locally. The successful exploitation requires a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 66006 (Fedora 18 : libuser-0.58-3.fc18 (2013-4571)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (66006). See VDB-146185 for similar entry.

Productinfo

Name

• libuser

Version

• 0.58-3.fc18

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion