CVE-2012-2095

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-04-07 · updated 2026-06-16
Weakness: CWE-20

Description

The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.

Affected products

David Paleino Wicd: through 1.7.1; 1.2.7, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.5.0 (+13)
Fedoraproject Fedora: 15, 16, 17

References

http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/751
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668397
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079025.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079029.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079055.html
http://secunia.com/advisories/48759
http://secunia.com/advisories/49657
http://www.exploit-db.com/exploits/18733
http://www.gentoo.org/security/en/glsa/glsa-201206-08.xml
http://www.infosecinstitute.com/courses/ethical-hacking-wicd-0day.html
http://www.openwall.com/lists/oss-security/2012/04/11/2
http://www.openwall.com/lists/oss-security/2012/04/11/3

Get alerted when CVE-2012-2095 or the next vulnerability affects your stack