PT-2014-6177 · Cryoserver · Cryoserver Security Appliance

Chris Hernandez · Publicado 2014-10-10 · Atualizado 2014-10-15 · CVE-2014-4867

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cryoserver Security Appliance version 7.3.x

Description The issue concerns weak permissions for the /etc/init.d/cryoserver file, allowing local users to escalate privileges. This can be achieved by accessing the support account and executing the /bin/cryo-mgmt program.

Recommendations For Cryoserver Security Appliance version 7.3.x, consider restricting access to the /etc/init.d/cryoserver file and the /bin/cryo-mgmt program to prevent privilege escalation. Additionally, review and secure the support account to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-4867

Produtos afetados

Cryoserver Security Appliance

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-4867 · Nota de Segurança
• http://kb.cert.org/vuls/id/280844 · Nota