PT-2014-6363 · Google · Ganeti

Published 2014-08-29 · Updated 2021-09-08 · CVE-2014-5247

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ganeti versions 2.10.0 through 2.10.6 Ganeti versions 2.11.0 through 2.11.4

Description The issue allows local users to obtain sensitive information, including SSL keys and remote API credentials, by reading a configuration backup file. This is related to the upgrade command and is due to the use of world-readable permissions for the configuration backup file by the UpgradeBeforeConfigurationChange function in lib/client/gnt cluster.py.

Recommendations For Ganeti versions 2.10.0 through 2.10.6, update to version 2.10.7 or later. For Ganeti versions 2.11.0 through 2.11.4, update to version 2.11.5 or later. As a temporary workaround, consider restricting access to the configuration backup file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-5247

Affected Products

Ganeti

References · 14

• 🔥 http://packetstormsecurity.com/files/127851/Ganeti-Insecure-Archive-Permission.html · Exploit
• https://ubuntu.com/security/CVE-2014-5247 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5247 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5247 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-5247 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5247 · Security Note
• https://osv.dev/vulnerability/CVE-2014-5247 · Vendor Advisory
• http://securityfocus.com/bid/69186 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95256 · Note
• http://seclists.org/oss-sec/2014/q3/370 · Note
• http://ocert.org/advisories/ocert-2014-006.html · Note
• http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=a89f62e2db9ccf715d64d1a6322474b54d2d9ae0 · Note
• http://securityfocus.com/archive/1/533119/100/0/threaded · Note