PT-2014-2466 · Canonical+1 · Ubuntu Metal As A Service+1

Elmo + 3 · Publicado 2014-02-17 · Atualizado 2014-02-21 · CVE-2013-1069

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu Metal as a Service (MaaS) versions 1.2 and 1.4

Description The issue allows local users to obtain RabbitMQ authentication credentials by reading a file with world-readable permissions. This affects the txlongpoll.yaml file.

Recommendations For Ubuntu Metal as a Service (MaaS) version 1.2, update the permissions of the txlongpoll.yaml file to restrict access. For Ubuntu Metal as a Service (MaaS) version 1.4, update the permissions of the txlongpoll.yaml file to restrict access.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-1069

Produtos afetados

Rabbitmq

Ubuntu Metal As A Service

Referências · 3

• https://bugs.launchpad.net/ubuntu/%2Bsource/maas/%2Bbug/1254034 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1069 · Nota de Segurança
• http://ubuntu.com/usn/USN-2105-1 · Aviso do Fabricante