PT-2014-5690 · Ibm+2 · Powerpc-Utils+2

Published 2014-06-17 · Updated 2025-11-10 · CVE-2014-4040

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions powerpc-utils version 1.2.20

Description The issue allows remote attackers to obtain sensitive information by leveraging access to a technical-support data stream, as the snap function in powerpc-utils produces an archive with fstab and yaboot.conf files that might contain cleartext passwords. It lacks a warning about reviewing this archive to detect included passwords.

Recommendations For powerpc-utils version 1.2.20, consider reviewing the archive produced by the snap function to detect any included passwords in the fstab and yaboot.conf files, and take necessary actions to secure sensitive information. As a temporary workaround, restrict access to the technical-support data stream to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-4040

RHSA-2015:0384

RHSA-2015_0384

SUSE-RU-2015:0574-1

SUSE-SU-2014_1211-1

SUSE-SU-2015:0232-1

SUSE-SU-2015_0232-1

SUSE-SU-2025:21067-1

Affected Products

Red Hat

Suse

Powerpc-Utils

References · 26

• https://nvd.nist.gov/vuln/detail/CVE-2014-4040 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4040 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-4040 · Security Note
• https://osv.dev/vulnerability/CVE-2014-4040 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4040 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21067-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0232-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4040 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0384.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4040 · Vendor Advisory
• https://bugzilla.suse.com/887275 · Note
• https://bugzilla.suse.com/886123 · Note
• https://suse.com/security/cve/CVE-2014-4040 · Note
• https://bugzilla.suse.com/901216 · Note
• https://suse.com/support/update/announcement/2015/suse-su-20150232-1 · Note