CVE-2013-6412: Augeas Incorrect Permissions on New Files Leading to Local Privilege Escalation

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2013-6412 Bugzilla ID: 1034261 Vulnerability: Incorrect permissions set on newly created files in augeas Status: CLOSED ERRATA Affected Products and Environments Product: Security Response Component: vulnerability OS: Linux Priority and Severity: Medium Reporting and Fix Details Reported Date: 2013-11-25 Modified Date: 2023-05-12 Last Closed: 2021-10-20 Fix: Committed upstream with changes to augeas code. Vulnerability Details Summary: Commit introduced a flaw in setting permissions for newly created files in augeas, resulting in files being world-writable. Impact: Local users could potentially use this to modify configuration files created by applications using augeas. Related CVEs CVE-2012-0786: Fix for this issue introduced a new flaw. Solutions and Patches Patch Submission: Patch submitted for review and merged upstream. RHSA: RHSA-2014:0044 Fedora and EPEL Updates: Fixes pushed to various Fedora and EPEL repositories. Discoverer Discoverer: Red Hat Security Response Team

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2013-6412: Augeas Incorrect Permissions on New Files Leading to Local Privilege Escalation