PT-2005-5348 · Padl · Padl Migrationtools

Jason Hoover · Published 2005-12-31 · Updated 2017-07-20 · CVE-2005-4683

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PADL MigrationTools version 46

Description The issue concerns the storage of sensitive information in temporary files when a failure occurs. Specifically, the contents of /etc/shadow are stored in a world-readable /tmp/nis.$$.ldif file. Other sensitive information may also be stored in temporary files. The scripts migrate all online.sh, migrate all offline.sh, migrate all netinfo online.sh, migrate all netinfo offline.sh, migrate all nis online.sh, migrate all nis offline.sh, migrate all nisplus online.sh, and migrate all nisplus offline.sh do not properly manage these temporary files.

Recommendations As a temporary workaround, consider restricting access to the temporary files generated by the affected scripts until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-4683

Affected Products

Padl Migrationtools

References · 9

• https://osv.dev/vulnerability/CVE-2005-4683 · Vendor Advisory
• http://secunia.com/advisories/17530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4683 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-4683 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-4683 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42335 · Note
• http://osvdb.org/20839 · Note
• http://vupen.com/english/advisories/2005/2427 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920 · Note