PT-2018-4234 · Ruby · Cap-Strap

Larry W. Cashdollar + 1 · Publicado 2018-01-10 · Atualizado 2018-03-16 · CVE-2014-4992

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cap-strap gem version 0.1.5

Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the useradd command line in the lib/cap-strap/helpers.rb file of the cap-strap gem for Ruby.

Recommendations For cap-strap gem version 0.1.5, consider updating to a newer version that does not place credentials on the command line, or as a temporary workaround, restrict access to sensitive information that could be exposed through process listing.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-4992

GHSA-PCM6-G2QP-9GW8

Produtos afetados

Cap-Strap

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cap-strap/CVE-2014-4992.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/cap-strap-0.1.5.html · Exploit
• https://github.com/substantial/cap-strap · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4992 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/07/07/9 · Nota
• https://github.com/advisories/GHSA-pcm6-g2qp-9gw8 · Nota
• http://openwall.com/lists/oss-security/2014/07/17/5 · Nota
• https://osv.dev/vulnerability/GHSA-pcm6-g2qp-9gw8 · Aviso do Fabricante