PT-2019-6543 · Openssl+1 · Openssl+1

Dominic Hargreaves · Publicado 2019-11-07 · Atualizado 2019-11-13 · CVE-2010-2450

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shibboleth SP version 2.0

Description The keygen.sh script in Shibboleth SP uses OpenSSL to create a DES private key, which is placed in sp-key.pm. This script relies on the root umask instead of setting the permissions for the resulting file, making the generated private key world-readable by default.

Recommendations For Shibboleth SP version 2.0, consider modifying the keygen.sh script to properly set the permissions for the generated private key, or manually change the permissions of the sp-key.pm file to prevent it from being world-readable. As a temporary workaround, restrict access to the sp-key.pm file to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-916

CWE-200

Identificadores relacionados

CVE-2010-2450

Produtos afetados

Openssl

Shibboleth-Sp

Referências · 5

• https://todos.internet2.edu/browse/SSPCPP-106 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631 · Correção
• https://security-tracker.debian.org/tracker/CVE-2010-2450 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2450 · Nota de Segurança
• https://t.me/cibsecurity/8091 · Publicação no Telegram