PT-2013-5036 · Openwrt+2 · Luci+2

Jan Pokorný + 1 · Published 2013-11-20 · Updated 2019-04-22 · CVE-2013-4481

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Luci version 0.26.0

Description A race condition exists that creates the /var/lib/luci/etc/luci.ini file with world-readable permissions before the permissions are restricted. This allows local users to read the file and obtain sensitive information, including authentication secrets.

Recommendations For Luci version 0.26.0, consider restricting access to the /var/lib/luci/etc/luci.ini file until a patch is available. As a temporary workaround, manually change the permissions of the luci.ini file to prevent unauthorized access.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CESA-2013_1603

CVE-2013-4481

RHSA-2013:1603

RHSA-2013_1603

Affected Products

Centos

Luci

Red Hat

References · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4481 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4482 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4481 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1603.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=988998 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/007204.html · Note
• https://access.redhat.com/security/cve/CVE-2013-4481 · Note
• https://rhn.redhat.com/errata/RHSA-2013-1603.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/027274.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/020584.html · Note
• https://access.redhat.com/errata/RHSA-2013:1603 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/013894.html · Note
• https://access.redhat.com/security/cve/CVE-2013-4482 · Note