PT-2014-6363 · Google · Ganeti

Publicado 2014-08-29 · Atualizado 2021-09-08 · CVE-2014-5247

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ganeti versions 2.10.0 through 2.10.6 Ganeti versions 2.11.0 through 2.11.4

Description The issue allows local users to obtain sensitive information, including SSL keys and remote API credentials, by reading a configuration backup file. This is related to the upgrade command and is due to the use of world-readable permissions for the configuration backup file by the UpgradeBeforeConfigurationChange function in lib/client/gnt cluster.py.

Recommendations For Ganeti versions 2.10.0 through 2.10.6, update to version 2.10.7 or later. For Ganeti versions 2.11.0 through 2.11.4, update to version 2.11.5 or later. As a temporary workaround, consider restricting access to the configuration backup file to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-5247

Produtos afetados

Ganeti

Referências · 14

• 🔥 http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html · Exploit
• http://securityfocus.com/bid/69186 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 · Nota
• https://ubuntu.com/security/CVE-2014-5247 · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q3/370 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5247 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5247 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5247 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-5247 · Aviso do Fabricante
• http://ocert.org/advisories/ocert-2014-006.html · Nota
• https://cve.org/CVERecord?id=CVE-2014-5247 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-5247 · Aviso do Fabricante
• http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 · Nota
• http://securityfocus.com/archive/1/533119/100/0/threaded · Nota