What is the CVSS score of CVE-2012-4453?

CVE-2012-4453 has a CVSS 2.0 base score of 2.1 (Low). CVSS vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2012-4453?

Yes, a patch is available for CVE-2012-4453. Update the affected software to the latest version immediately.

Dracut CVE-2012-4453

LOW

Incorrect Default Permissions (CWE-276)

2012-10-09 secalert@redhat.com

Red Hat Privilege Escalation Dracut Fedora Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Workstation

2.1

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

AV:L/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 09, 2012 - 23:55 cve.org

LOW 2.1

DescriptionCVE.org

AnalysisAI

dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information. Affected products include: Dracut Project Dracut, Fedoraproject Fedora, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.