PT-2006-7216 · Fai · Fai

Justin R. Beckley · Published 2006-12-18 · Updated 2017-07-29 · CVE-2006-6614

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FAI versions 2.10.1 through 3.1.2

Description The issue concerns the storage of sensitive information. In verbose mode, the save log local function stores the root password hash in a log file. This file can be copied to other hosts under certain conditions, potentially allowing attackers to obtain the hash.

Recommendations For FAI version 2.10.1, consider disabling verbose mode to prevent the storage of the root password hash in the log file. For FAI version 3.1.2, restrict access to the log file to minimize the risk of the hash being obtained by unauthorized parties. As a temporary workaround, consider modifying the file permissions of /var/log/fai/current/fai.log to prevent it from being copied to other hosts when fai-savelog is called.

Exploit

Fix

Related Identifiers

CVE-2006-6614

Affected Products

Fai

References · 9

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644 · Exploit
• https://osv.dev/vulnerability/CVE-2006-6614 · Vendor Advisory
• http://secunia.com/advisories/23330 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6614 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-6614 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4995 · Note
• http://securityfocus.com/bid/21579 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30892 · Note