PT-2006-2835 · Debian · Base-Config+1

Joey Hess · Publicado 2006-04-19 · Atualizado 2020-08-11 · CVE-2006-1844

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Debian installer for shadow version 4.0.14 Debian installer for base-config version 2.53.10

Description The issue concerns sensitive information being included in world-readable log files by the Debian installer. This information includes preseeded passwords and pppoeconf passwords, which could potentially allow local users to gain privileges.

Recommendations For shadow version 4.0.14, restrict access to the log files generated by the Debian installer to prevent unauthorized users from reading sensitive information. For base-config version 2.53.10, consider modifying the installer to exclude sensitive information from log files or apply appropriate permissions to limit access to these logs.

Correção

Identificadores relacionados

CVE-2006-1844

Produtos afetados

Debian

Base-Config

Referências · 7

• https://security-tracker.debian.org/tracker/CVE-2006-1844 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-1844 · Aviso do Fabricante
• http://secunia.com/advisories/19170 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356939 · Correção
• http://osvdb.org/23922 · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1844 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1844 · Nota de Segurança