PT-2013-1801 · Red Hat · Aeolus Configuration Server

Aaron Weitekamp · Published 2013-03-12 · Updated 2023-02-13 · CVE-2012-5509

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aeolus Configuration Server versions prior to 1.1.2

Description The issue concerns the aeolus-configserver-setup in the Aeolus Configuration Server, which is used in Red Hat CloudForms Cloud Engine. It uses world-readable permissions for a temporary file in /tmp. This allows local users to read credentials by accessing this file.

Recommendations For versions prior to 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary files in /tmp to minimize the risk of credential exposure.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-5509

Affected Products

Aeolus Configuration Server

References · 3

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=875294 · Exploit
• http://rhn.redhat.com/errata/RHSA-2013-0545.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5509 · Security Note