PT-2014-6262 · Eucalyptus Systems · Eucalyptus

Published 2014-11-07 · Updated 2014-11-10 · CVE-2014-5037

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eucalyptus versions 4.0.0 through 4.0.1

Description The issue allows local users to obtain sensitive information by reading cloud-requests.log when the log level is set to INFO. This is because user and system passwords are logged, which can be accessed locally.

Recommendations For Eucalyptus versions 4.0.0 through 4.0.1, consider changing the log level from INFO to a less sensitive setting to prevent logging of user and system passwords. Additionally, restrict access to the cloud-requests.log file to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-5037

Affected Products

Eucalyptus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-5037 · Security Note
• https://eucalyptus.com/resources/security/advisories/esa-25 · Vendor Advisory
• http://secunia.com/advisories/62055 · Note