PT-2014-7890 · Centrify · Centrify Directcontrol+1

Publicado 2014-10-24 · Atualizado 2014-10-24 · CVE-2014-7298

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Centrify Server Suite versions 2008 through 2014.1 Centrify DirectControl versions 3.x through 4.2.0

Description The issue allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality in adsetgroups.

Recommendations For Centrify Server Suite versions 2008 through 2014.1, update to a version that addresses the improper setuid functionality issue. For Centrify DirectControl versions 3.x through 4.2.0, update to a version that addresses the improper setuid functionality issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-7298

Produtos afetados

Centrify Directcontrol

Centrify Server Suite

Referências · 4

• http://twitter.com/travemme/statuses/525298393971564544 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7298 · Nota de Segurança
• http://centrify.com/support/announcements.asp#20141014 · Nota
• https://exploithub.com/centrify-data-leakage.html · Nota