PT-2014-5611 · Red Hat+1 · Red Hat Sos+1

Dolev Farhi · Published 2014-06-01 · Updated 2016-04-06 · CVE-2014-3925

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat sos versions 1.7 and earlier

Description The issue concerns the sosreport in Red Hat sos, which generates an archive that may contain cleartext passwords in the fstab file. This archive lacks a warning about reviewing its contents to detect included passwords. As a result, remote attackers might obtain sensitive information by accessing a technical-support data stream.

Recommendations For Red Hat sos versions 1.7 and earlier, review the archive generated by sosreport for cleartext passwords in the fstab file and remove or secure any sensitive information before sharing the archive. Consider adding a warning to review the archive for included passwords to prevent unintended disclosure of sensitive information.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-3925

USN-2845-1

Affected Products

Red Hat Sos

Ubuntu

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2014-3925 · Security Note
• https://ubuntu.com/security/CVE-2015-7529 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7529 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3925 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3925 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1102633 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2845-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3925 · Vendor Advisory
• http://ubuntu.com/usn/USN-2845-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2845-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3925 · Security Note
• http://openwall.com/lists/oss-security/2014/05/29/6 · Note
• http://openwall.com/lists/oss-security/2014/05/30/3 · Note