PT-2006-2763 · Mnogosearch+1 · Mnogosearch-Common+1

Andrew Pam · Published 2006-04-13 · Updated 2008-09-05 · CVE-2006-1772

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Debian GNU/Linux mnogosearch-common version 3.2.31-1

Description The issue allows local users to view the database administrator password due to the use of a world-readable config.dat file for storing the cleartext password in the mnogosearch-common/database admin pass record.

Recommendations For mnogosearch-common version 3.2.31-1, consider restricting access to the config.dat file until a patch is available. As a temporary workaround, avoid using the mnogosearch-common/database admin pass record to store sensitive information.

Fix

Related Identifiers

CVE-2006-1772

Affected Products

Debian

Mnogosearch-Common

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-1772 · Security Note
• http://securityfocus.com/bid/17477 · Note
• http://secunia.com/advisories/19589 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361775 · Note