cve-2012-6119
Vulnerability from cvelistv5
Published
2013-04-02 22:00
Modified
2024-08-06 21:28
Severity
Summary
Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.
References
SourceURLTags
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0686.htmlVendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/52774Vendor Advisory
secalert@redhat.comhttp://www.osvdb.org/91719
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=908613
secalert@redhat.comhttps://github.com/candlepin/candlepin/blob/master/candlepin.spec
secalert@redhat.comhttps://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c
Impacted products
VendorProduct
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:28:38.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "52774",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52774"
          },
          {
            "name": "91719",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/91719"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/candlepin/candlepin/blob/master/candlepin.spec"
          },
          {
            "name": "RHSA-2013:0686",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-04-02T22:00:00Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "52774",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52774"
        },
        {
          "name": "91719",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/91719"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/candlepin/candlepin/blob/master/candlepin.spec"
        },
        {
          "name": "RHSA-2013:0686",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-6119",
    "datePublished": "2013-04-02T22:00:00Z",
    "dateReserved": "2012-12-06T00:00:00Z",
    "dateUpdated": "2024-08-06T21:28:38.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-6119\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-04-02T22:55:01.237\",\"lastModified\":\"2013-04-03T04:00:00.000\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.\"},{\"lang\":\"es\",\"value\":\"Candlepin antes de v0.7.24, tal como se utiliza en el Administrador de Activos de Red Hat Suscripci\u00f3n antes de v1.2.1, no comprueba correctamente firmas de los manifest, que permite a usuarios locales modificarlos.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:P/A:N\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":2.1},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.7.2\",\"matchCriteriaId\":\"6B1D9F06-42FF-43F3-9227-F1524BB8838B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:0.4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20B7A721-F0EC-4E44-A276-E849D06EA048\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:0.4.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8ECDE2F9-B94F-4B8C-9D20-3A1C96729050\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:0.4.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F8F8633-9313-42D8-B309-D81DF467FE11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:0.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A932DE3-11C2-4852-A803-73BB0DBDE22A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:candlepinproject:candlepin:0.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3878FE4-235F-4902-ABCE-CFDBD2C32964\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:subscription_asset_manager:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.0\",\"matchCriteriaId\":\"E20A0D71-54E5-4165-BE9F-5668B59622AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:subscription_asset_manager:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1AEAC18-A40A-4F25-9C41-FD72F577292B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:subscription_asset_manager:1.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CB43793-470F-4C24-AC75-A2555CA68A70\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0686.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/52774\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.osvdb.org/91719\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=908613\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/candlepin/candlepin/blob/master/candlepin.spec\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/candlepin/candlepin/commit/f4d93230e58b969c506b4c9778e04482a059b08c\",\"source\":\"secalert@redhat.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.