CVE-2014-4040 snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwo...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/powerpc-utils(Debian:12) | < 1.3.1-2 | 1.3.1-2 |
| debian/powerpc-utils(Debian:13) | < 1.3.1-2 | 1.3.1-2 |
| debian/powerpc-utils(Debian:14) | < 1.3.1-2 | 1.3.1-2 |
| powerpc-utils project powerpc-utils | = 1.2.20 | No fix listed |
References
- Debian Security Tracker CVE-2014-4040 vendor-advisory
- [oss-security] 20140617 Re: CVE request: multiple /tmp races in ppc64-diag mailing-list
- RHSA-2015:0384 vendor-advisory