PT-2014-5552 · Pyplate · Pyplate

Henri Salo · Published 2014-08-07 · Updated 2014-08-07 · CVE-2014-3851

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08

Description The issue concerns a file permission setting in Pyplate that allows local users to access sensitive information. Specifically, the create passwd file.py script sets world-readable permissions for the passwd.db file, which contains the administrator password. This setting enables local users to read the file and obtain the administrator password.

Recommendations For Pyplate version 0.08, consider changing the permissions of the passwd.db file to restrict access and prevent local users from reading it. As a temporary workaround, restrict access to the create passwd file.py script until a proper fix is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3851

Affected Products

Pyplate

References · 3

• 🔥 http://openwall.com/lists/oss-security/2014/05/14/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3851 · Security Note
• http://openwall.com/lists/oss-security/2014/05/23/1 · Note