CVE-2012-0054: GoLismero symlink attack

May 4, 2022 (updated November 22, 2024)

libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat.

References

github.com/advisories/GHSA-vwxc-3cfr-37jq
github.com/golismero/golismero
github.com/pypa/advisory-database/tree/main/vulns/golismero/PYSEC-2012-31.yaml
nvd.nist.gov/vuln/detail/CVE-2012-0054

Code Behaviors & Features

Detect and mitigate CVE-2012-0054 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →