CVE-2012-0051
📋 TL;DR
CVE-2012-0051 is an integrity vulnerability in Tahoe-LAFS 1.9.0 where remote attackers can corrupt mutable files or directories during retrieval. This affects users of Tahoe-LAFS 1.9.0 who retrieve mutable files from potentially malicious storage servers.
💻 Affected Systems
- Tahoe-LAFS
📦 What is this software?
Tahoe Lafs by Tahoe Lafs
⚠️ Risk & Real-World Impact
Worst Case
Critical mutable files or directories become corrupted and unrecoverable, leading to data loss or system compromise if those files contain executable code or configuration.
Likely Case
Data corruption of mutable files retrieved from untrusted storage servers, potentially causing application errors or data integrity issues.
If Mitigated
Minimal impact if using only immutable files, trusted storage servers, or patched versions.
🎯 Exploit Status
Exploitation requires attacker to control or compromise a storage server that hosts mutable files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.1 and later
Vendor Advisory: https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1555
Restart Required: Yes
Instructions:
1. Upgrade Tahoe-LAFS to version 1.9.1 or later. 2. Restart all Tahoe-LAFS services. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Use immutable files only
allAvoid using mutable files/directories; store all data as immutable files which are not vulnerable.
Restrict to trusted storage servers
allOnly retrieve mutable files from storage servers you fully trust and control.
🧯 If You Can't Patch
- Disable mutable file functionality entirely if possible
- Implement strict network segmentation to isolate Tahoe-LAFS from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Tahoe-LAFS version: if running 1.9.0, you are vulnerable.Check Version:
tahoe --versionVerify Fix Applied:
Verify Tahoe-LAFS version is 1.9.1 or later and that services have been restarted.📡 Detection & Monitoring
Log Indicators:
- Unexpected file corruption errors in Tahoe-LAFS logs
- Failed integrity checks on mutable files
Network Indicators:
- Unusual connections to storage servers from untrusted sources
SIEM Query:
source="tahoe-lafs" AND (error OR corruption OR integrity)🔗 References
- http://www.openwall.com/lists/oss-security/2012/01/15/11
- http://www.openwall.com/lists/oss-security/2012/01/26/7
- http://www.openwall.com/lists/oss-security/2012/01/26/8
- http://www.openwall.com/lists/oss-security/2012/01/26/9
- https://security-tracker.debian.org/tracker/CVE-2012-0051
- https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1654
- http://www.openwall.com/lists/oss-security/2012/01/15/11
- http://www.openwall.com/lists/oss-security/2012/01/26/7
- http://www.openwall.com/lists/oss-security/2012/01/26/8
- http://www.openwall.com/lists/oss-security/2012/01/26/9
- https://security-tracker.debian.org/tracker/CVE-2012-0051
- https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1654
