PT-2013-1801 · Red Hat · Aeolus Configuration Server

Aaron Weitekamp · Publicado 2013-03-12 · Atualizado 2023-02-13 · CVE-2012-5509

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aeolus Configuration Server versions prior to 1.1.2

Description The issue concerns the aeolus-configserver-setup in the Aeolus Configuration Server, which is used in Red Hat CloudForms Cloud Engine. It uses world-readable permissions for a temporary file in /tmp. This allows local users to read credentials by accessing this file.

Recommendations For versions prior to 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary files in /tmp to minimize the risk of credential exposure.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-5509

Produtos afetados

Aeolus Configuration Server

Referências · 3

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=875294 · Exploit
• http://rhn.redhat.com/errata/RHSA-2013-0545.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5509 · Nota de Segurança