PT-2006-7216 · Fai · Fai

Justin R. Beckley · Publicado 2006-12-18 · Atualizado 2017-07-29 · CVE-2006-6614

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FAI versions 2.10.1 through 3.1.2

Description The issue concerns the storage of sensitive information. In verbose mode, the save log local function stores the root password hash in a log file. This file can be copied to other hosts under certain conditions, potentially allowing attackers to obtain the hash.

Recommendations For FAI version 2.10.1, consider disabling verbose mode to prevent the storage of the root password hash in the log file. For FAI version 3.1.2, restrict access to the log file to minimize the risk of the hash being obtained by unauthorized parties. As a temporary workaround, consider modifying the file permissions of /var/log/fai/current/fai.log to prevent it from being copied to other hosts when fai-savelog is called.

Exploit

Correção

Identificadores relacionados

CVE-2006-6614

Produtos afetados

Fai

Referências · 9

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644 · Exploit
• https://osv.dev/vulnerability/CVE-2006-6614 · Aviso do Fabricante
• http://secunia.com/advisories/23330 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4995 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6614 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6614 · Nota de Segurança
• http://securityfocus.com/bid/21579 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30892 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-6614 · Aviso do Fabricante