PT-2018-4235 · Openssl+1 · Openssl+2

Larry W. Cashdollar + 1 · Published 2018-01-10 · Updated 2022-05-14 · CVE-2014-4993

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions backup-agoddard gem version 3.0.28 backup checksum gem version 3.0.23

Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the openssl command line in the lib/backup/cli/utility.rb file of the affected gems.

Recommendations For backup-agoddard gem version 3.0.28, consider updating to a version where the credentials are not placed on the openssl command line. For backup checksum gem version 3.0.23, consider updating to a version where the credentials are not placed on the openssl command line. As a temporary workaround, consider restricting access to the lib/backup/cli/utility.rb file to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-4993

GHSA-WR5J-Q359-6VR2

Affected Products

Backup-Agoddard

Backup Checksum

Openssl

References · 8

• 🔥 http://vapid.dhs.org/advisories/backup-agoddard-3.0.28.html · Exploit
• 🔥 http://vapid.dhs.org/advisories/backup_checksum-3.0.23.html · Exploit
• https://osv.dev/vulnerability/GHSA-wr5j-q359-6vr2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4993 · Security Note
• https://github.com/agoddard/backup · Note
• http://openwall.com/lists/oss-security/2014/07/07/12 · Note
• http://openwall.com/lists/oss-security/2014/07/07/11 · Note
• http://openwall.com/lists/oss-security/2014/07/17/5 · Note