CVE-2012-4455

Name of the Vulnerable Software and Affected Versions openCryptoki version 2.4.1

Description The issue allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki stdll file in /var/lock/.

Recommendations For openCryptoki version 2.4.1, consider restricting access to the /var/lock/ directory to prevent symlink attacks on the LCK..opencryptoki and LCK..opencryptoki stdll files until a patch is available.