CVE-2012-5644

Red Hat statement

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Red Hat mitigation

There are several restrictions to successful exploitation of this flaw: ~~~ 1. ONLY applications compiled with libuser are affected. The affected code is hit only when a move operation is conducted on user home directory. 2. The attacker needs to have a shell account on the target machine. 3. Since this is a TOCTOU attack, precise timing is required for the attack. The attacker needs to know exactly when the move directory is moved in order successfully exploit this flaw. ~~~ Any other application acting on user directories (not compiled with libuser) for example usermod/userdel are not affected by this flaw.