PT-2012-1092 · Sos+2 · Sos+2
Publicado
2012-06-19
·
Atualizado
2017-08-29
·
CVE-2012-2664
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
sos package versions prior to 2.2-29
Description
The issue concerns the sosreport utility in the sos package, which does not properly remove the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information. This could allow attackers to obtain passwords or password hashes. The exploitation of this issue can be done remotely.
Recommendations
For versions prior to 2.2-29, update the sos package to version 2.2-29 or later to resolve the issue. As a temporary workaround, consider manually removing the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) before creating an archive of debugging information.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Sos