PT-2014-5084 · Ibm · Ibm Powervc

Publicado 2014-08-29 · Atualizado 2017-08-29 · CVE-2014-3093

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM PowerVC versions 1.2.0 through 1.2.0 before FP3 IBM PowerVC versions 1.2.1 through 1.2.1 before FP2

Description The issue allows local users to obtain sensitive information. This is because cleartext passwords are used in various components, including api-paste.ini, debug logs, the installation process, environment checks, powervc-ldap-config, powervc-restore, and powervc-diag. A local user can exploit this by entering a ps command or reading a file.

Recommendations For IBM PowerVC version 1.2.0 before FP3, update to FP3 or later. For IBM PowerVC version 1.2.1 before FP2, update to FP2 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-3093

Produtos afetados

Ibm Powervc

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3093 · Nota de Segurança
• http://securityfocus.com/bid/69437 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94259 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=nas8N1020242 · Aviso do Fabricante