ID CVE-2010-2450
Summary The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.
References
Vulnerable Configurations
  • cpe:2.3:a:shibboleth:service_provider:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:service_provider:2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-916
CAPEC
Access
VectorComplexityAuthentication
Impact
ConfidentialityIntegrityAvailability
Last major update 07-11-2019 - 21:15
Published 07-11-2019 - 21:15
Last modified 13-11-2019 - 18:48
Back to Top