PT-2018-3574 · Unknown+2 · Keepalived+2
Jsegitz
·
Publicado
2018-10-25
·
Atualizado
2024-06-15
·
CVE-2018-19046
CVSS v3.1
4.7
Média
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
keepalived version 2.0.8
Description
The issue is related to the handling of temporary files when the
PrintData or PrintStats functions are called. A local attacker could potentially exploit this by creating a file with a specific name, such as /tmp/keepalived.data or /tmp/keepalived.stats, with read access for the attacker and write access for the keepalived process. This could lead to the leakage of sensitive information.Recommendations
For keepalived version 2.0.8, consider restricting access to the temporary files used by the
PrintData and PrintStats functions to prevent potential information leakage. As a temporary workaround, avoid using the PrintData and PrintStats functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Keepalived