PT-2014-6262 · Eucalyptus Systems · Eucalyptus

Publicado 2014-11-07 · Atualizado 2014-11-10 · CVE-2014-5037

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eucalyptus versions 4.0.0 through 4.0.1

Description The issue allows local users to obtain sensitive information by reading cloud-requests.log when the log level is set to INFO. This is because user and system passwords are logged, which can be accessed locally.

Recommendations For Eucalyptus versions 4.0.0 through 4.0.1, consider changing the log level from INFO to a less sensitive setting to prevent logging of user and system passwords. Additionally, restrict access to the cloud-requests.log file to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-5037

Produtos afetados

Eucalyptus

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-5037 · Nota de Segurança
• https://eucalyptus.com/resources/security/advisories/esa-25 · Aviso do Fabricante
• http://secunia.com/advisories/62055 · Nota