PT-2017-5839 · Percona+1 · Percona-Toolkit+1

Publicado 2014-03-06 · Atualizado 2024-06-15 · CVE-2014-2029

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Percona Toolkit version 2.1

Description: The automatic version check functionality in Percona Toolkit allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code. This is possible due to the use of HTTP to download configuration information from v.percona.com, which makes it vulnerable to interception and manipulation.

Recommendations: For Percona Toolkit version 2.1, consider disabling the automatic version check functionality as a temporary workaround until a patch is available. Restrict access to sensitive information and configuration downloads to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-2029

OPENSUSE-SU-2014_0333-1

OPENSUSE-SU-2024:10095-1

OPENSUSE-SU-2024:10120-1

Produtos afetados

Percona-Toolkit

Suse

Referências · 19

• http://support.novell.com/security/cve/CVE-2014-2029.html · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10095-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-2029 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-2029 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-2029 · Aviso do Fabricante
• https://bugzilla.novell.com/show_bug.cgi?id=864194 · Correção
• https://suse.com/security/cve/CVE-2014-2029 · Nota
• http://openwall.com/lists/oss-security/2014/02/19/14 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10120-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-2029 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2029 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/02/18/4 · Nota
• https://bugs.launchpad.net/percona-toolkit/+bug/1279502 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/5Q6BYQN7S6PAZG36PIGXWWZTQBMQQKKL · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2029 · Aviso do Fabricante