CVE-2012-2291

Published: Jan 21, 2013Modified: Apr 29, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.

Affected (12)

Products: Emc: Avamar, Avamar Plugin

Emc

2 products

Avamar

Avamar Plugin

Configuration A

8 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Emc Avamar	Version 4.0
Emc Avamar	Version 4.1
Emc Avamar	Version 5.0.0-407
Emc Avamar	Version 5.0.4-26
Emc Avamar	Version 5.0
Emc Avamar	Version 5.0 sp1
Emc Avamar	Version 5.0 sp2
Emc Avamar	Version 6.0

Running on/with	Platform Versions
Apple Mac Os X	All versions
Hp Hp Ux	All versions

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Emc Avamar Plugin	Version 4.0
Emc Avamar Plugin	Version 5.0
Emc Avamar Plugin	Version 6.0
Emc Avamar Plugin	Version 6.1

Related CWEs

CWE-264

References (2)

http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html

Source: security_alert@emc.com

http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.