1. CVE-Search
  2. CVE-2014-4040
ID CVE-2014-4040
Summary snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
References
Vulnerable Configurations
  • cpe:2.3:a:powerpc-utils_project:powerpc-utils:1.2.20:*:*:*:*:*:*:*
    cpe:2.3:a:powerpc-utils_project:powerpc-utils:1.2.20:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 12-03-2015 - 01:59)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
redhat via4
advisories
bugzilla
id 1110520
title CVE-2014-4040 powerpc-utils: snap creates archives with fstab and yaboot.conf which may expose certain passwords
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 7 is installed
      oval oval:com.redhat.rhba:tst:20150364027
    • comment powerpc-utils is earlier than 0:1.2.24-7.el7
      oval oval:com.redhat.rhsa:tst:20150384001
    • comment powerpc-utils is signed with Red Hat redhatrelease2 key
      oval oval:com.redhat.rhsa:tst:20150384002
rhsa
id RHSA-2015:0384
released 2015-03-05
severity Low
title RHSA-2015:0384: powerpc-utils security, bug fix, and enhancement update (Low)
rpms
  • powerpc-utils-0:1.2.24-7.el7
  • powerpc-utils-debuginfo-0:1.2.24-7.el7
refmap via4
mlist [oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag
Last major update 12-03-2015 - 01:59
Published 17-06-2014 - 15:55
Last modified 12-03-2015 - 01:59
Back to Top