PT-2014-5552 · Pyplate · Pyplate

Henri Salo · Publicado 2014-08-07 · Atualizado 2014-08-07 · CVE-2014-3851

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08

Description The issue concerns a file permission setting in Pyplate that allows local users to access sensitive information. Specifically, the create passwd file.py script sets world-readable permissions for the passwd.db file, which contains the administrator password. This setting enables local users to read the file and obtain the administrator password.

Recommendations For Pyplate version 0.08, consider changing the permissions of the passwd.db file to restrict access and prevent local users from reading it. As a temporary workaround, restrict access to the create passwd file.py script until a proper fix is applied.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3851

Produtos afetados

Pyplate

Referências · 3

• 🔥 http://openwall.com/lists/oss-security/2014/05/14/3 · Exploit
• http://openwall.com/lists/oss-security/2014/05/23/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3851 · Nota de Segurança