PT-2018-4235 · Openssl+1 · Openssl+2

Larry W. Cashdollar + 1 · Publicado 2018-01-10 · Atualizado 2022-05-14 · CVE-2014-4993

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions backup-agoddard gem version 3.0.28 backup checksum gem version 3.0.23

Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the openssl command line in the lib/backup/cli/utility.rb file of the affected gems.

Recommendations For backup-agoddard gem version 3.0.28, consider updating to a version where the credentials are not placed on the openssl command line. For backup checksum gem version 3.0.23, consider updating to a version where the credentials are not placed on the openssl command line. As a temporary workaround, consider restricting access to the lib/backup/cli/utility.rb file to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-4993

GHSA-WR5J-Q359-6VR2

Produtos afetados

Backup-Agoddard

Backup Checksum

Openssl

Referências · 8

• 🔥 http://vapid.dhs.org/advisories/backup-agoddard-3.0.28.html · Exploit
• 🔥 http://vapid.dhs.org/advisories/backup_checksum-3.0.23.html · Exploit
• https://osv.dev/vulnerability/GHSA-wr5j-q359-6vr2 · Aviso do Fabricante
• https://github.com/agoddard/backup · Nota
• http://openwall.com/lists/oss-security/2014/07/07/12 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4993 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/07/07/11 · Nota
• http://openwall.com/lists/oss-security/2014/07/17/5 · Nota