|
|
| |
|
| |
android-tools: udev rules set insecure permissions
| Package(s): | android-tools |
CVE #(s): | |
| Created: | May 21, 2012 |
Updated: | December 4, 2012 |
| Description: |
From the Red Hat bugzilla:
udev rules file packaged with android-tools consists of rules like this:
SUBSYSTEM=="usb", ATTR{idVendor}=="0502", MODE="0666"
IOW for *any* device with the given vendor ID, its associated device nodes will be world-writable.
Despite it follows the upstream guidelines at http://developer.android.com/guide/developing/device.html, this is obviously insecure and contradicts the common practice of using ACL to grant access to the current console user via TAG+="uaccess". |
| Alerts: |
|
( Log in to post comments)
|
|
|