PT-2014-2140 · Apache+2 · Apache Http Server+2

Ansgar Burchardt · Publicado 2014-03-20 · Atualizado 2014-03-27 · CVE-2011-3196

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Domain Technologie Control (DTC) versions prior to 0.34.1

Description The setup script in DTC uses world-readable permissions for the /etc/apache2/apache2.conf file, allowing local users to obtain the dtcdaemons MySQL password by reading the file.

Recommendations For versions prior to 0.34.1, update to version 0.34.1 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/apache2/apache2.conf file to restrict access until a patch is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-3196

DSA-2365-1

Produtos afetados

Apache Http Server

Domain Technologie Control

Mysql Server

Referências · 6

• http://openwall.com/lists/oss-security/2011/08/24/10 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3196 · Nota de Segurança
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637485 · Nota
• http://openwall.com/lists/oss-security/2011/08/13/1 · Nota
• http://debian.org/security/2011/dsa-2365 · Aviso do Fabricante
• http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3 · Nota