PT-2014-2917 · Secunia+1 · Secunia Csi Agent+1

Publicado 2014-01-26 · Atualizado 2018-12-13 · CVE-2013-5364

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Secunia CSI Agent versions 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, 7.0.0.21 and earlier

Description The issue allows local users to modify the configuration of the CSI Agent by changing the permissions of the /etc/csia config.xml file, which has world-readable and world-writable permissions when running on Red Hat Linux.

Recommendations For versions 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, consider changing the permissions of the /etc/csia config.xml file to prevent local users from modifying the CSI Agent configuration. Restrict write access to the /etc/csia config.xml file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-5364

Produtos afetados

Red Hat

Secunia Csi Agent

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-5364 · Nota de Segurança
• http://osvdb.org/101901 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90230 · Nota
• http://secunia.com/advisories/56380 · Nota
• http://secunia.com/vulnerability_scanning/corporate/release-history · Nota
• http://securityfocus.com/bid/64775 · Nota