PT-2013-5036 · Openwrt+2 · Luci+2

Jan Pokorný + 1 · Publicado 2013-11-20 · Atualizado 2019-04-22 · CVE-2013-4481

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Luci version 0.26.0

Description A race condition exists that creates the /var/lib/luci/etc/luci.ini file with world-readable permissions before the permissions are restricted. This allows local users to read the file and obtain sensitive information, including authentication secrets.

Recommendations For Luci version 0.26.0, consider restricting access to the /var/lib/luci/etc/luci.ini file until a patch is available. As a temporary workaround, manually change the permissions of the luci.ini file to prevent unauthorized access.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CESA-2013_1603

CVE-2013-4481

RHSA-2013:1603

RHSA-2013_1603

Produtos afetados

Centos

Luci

Red Hat

Referências · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4481 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4482 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=988998 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/007204.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4481 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2013-4481 · Nota
• https://rhn.redhat.com/errata/RHSA-2013-1603.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/027274.html · Nota
• http://rhn.redhat.com/errata/RHSA-2013-1603.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/020584.html · Nota
• https://access.redhat.com/errata/RHSA-2013:1603 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/013894.html · Nota
• https://access.redhat.com/security/cve/CVE-2013-4482 · Nota