PT-2013-1225 · Red Hat+1 · Red Hat Openstack+1

Publicado 2013-04-10 · Atualizado 2013-08-23 · CVE-2012-6120

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat OpenStack versions Essex and Folsom Puppet versions prior to 2.7.23

Description The issue allows local users to obtain sensitive information, such as Puppet log files, due to the world-readable permissions of the /var/log/puppet directory. Additionally, multiple vulnerabilities in the Puppet package can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely by an authenticated attacker.

Recommendations For Red Hat OpenStack versions Essex and Folsom, consider changing the permissions of the /var/log/puppet directory to restrict access to sensitive information. For Puppet versions prior to 2.7.23, update to version 2.7.23 or later to resolve the vulnerabilities.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09724

CVE-2012-6120

DLA-29-1

RHSA-2013:0710

Produtos afetados

Puppet

Red Hat Openstack

Referências · 7

• http://security.gentoo.org/glsa/glsa-201308-04.xml · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0710.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6120 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09724 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2012-6120 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2012-6120 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-6120 · Aviso do Fabricante