CVE-2012-0054: GoLismero symlink attack

May 4, 2022 (updated November 22, 2024)

libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat.

References

github.com/advisories/GHSA-vwxc-3cfr-37jq
github.com/golismero/golismero
github.com/pypa/advisory-database/tree/main/vulns/golismero/PYSEC-2012-31.yaml
nvd.nist.gov/vuln/detail/CVE-2012-0054

Detect and mitigate CVE-2012-0054 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →