PT-2018-4237 · Ruby+1 · Vladtheenterprising+1

Larry W. Cashdollar + 1 · Published 2018-01-10 · Updated 2022-05-14 · CVE-2014-4995

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VladTheEnterprising gem version 0.2

Description The issue allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed, due to a race condition in the lib/vlad/dba/mysql.rb file.

Recommendations For version 0.2 of the VladTheEnterprising gem, consider restricting access to the temporary files created by the lib/vlad/dba/mysql.rb file until a patch is available. As a temporary workaround, avoid using the vulnerable function in lib/vlad/dba/mysql.rb that handles the MySQL root password. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Information Disclosure

Weakness Enumeration

CWE-362

CWE-200

Related Identifiers

CVE-2014-4995

GHSA-86CF-G34F-7462

Affected Products

Mysql Server

Vladtheenterprising

References · 8

• https://osv.dev/vulnerability/GHSA-86cf-g34f-7462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4995 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94745 · Note
• https://web.archive.org/web/20200229054941/http://securityfocus.com/bid/68729 · Note
• http://openwall.com/lists/oss-security/2014/07/07/14 · Note
• http://vapid.dhs.org/advisories/VladTheEnterprising-0.2.html · Note
• http://securityfocus.com/bid/68729 · Note
• http://openwall.com/lists/oss-security/2014/07/17/5 · Note