PT-2013-1900 · Red Hat · Red Hat Enterprise Virtualization Manager

Andrew Cathrow · Publicado 2013-03-12 · Atualizado 2023-02-13 · CVE-2012-6115

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization Manager versions 3.1 and earlier

Description The issue affects the domain management tool, specifically when the validate action is enabled, causing the administrative password to be logged to a world-readable log file. This allows local users to obtain sensitive information by reading the log file.

Recommendations For Red Hat Enterprise Virtualization Manager versions 3.1 and earlier, consider disabling the validate action in the domain management tool to prevent the administrative password from being logged to a world-readable log file. Restrict access to the log file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-6115

RHSA-2013:0211

Produtos afetados

Red Hat Enterprise Virtualization Manager

Referências · 7

• https://bugzilla.redhat.com/show_bug.cgi?id=893355 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0211.html · Aviso do Fabricante
• http://securityfocus.com/bid/57749 · Nota
• http://securitytracker.com/id/1028076 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81833 · Nota
• http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commit%3Bh=e8c72daec4efa8be0fcd8ea55c41e855ddd8eedf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6115 · Nota de Segurança