PT-2014-6177 · Cryoserver · Cryoserver Security Appliance

Chris Hernandez · Published 2014-10-10 · Updated 2014-10-15 · CVE-2014-4867

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cryoserver Security Appliance version 7.3.x

Description The issue concerns weak permissions for the /etc/init.d/cryoserver file, allowing local users to escalate privileges. This can be achieved by accessing the support account and executing the /bin/cryo-mgmt program.

Recommendations For Cryoserver Security Appliance version 7.3.x, consider restricting access to the /etc/init.d/cryoserver file and the /bin/cryo-mgmt program to prevent privilege escalation. Additionally, review and secure the support account to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4867

Affected Products

Cryoserver Security Appliance

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-4867 · Security Note
• http://kb.cert.org/vuls/id/280844 · Note