Sign-up

ID

VAR-201409-1157


TITLE

OSSEC '.passlist' Unsafe File Permission Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2014-06115

DESCRIPTION

OSSEC is an open source multi-platform intrusion detection system developed by the OSSEC team. The system provides functions such as log analysis, file integrity detection, and real-time alarms. A local insecure file permission vulnerability exists in OSSEC. This vulnerability could be used by a local attacker to gain access to globally readable files and sensitive information. There are vulnerabilities in OSSEC 2.8, other versions may also be affected

Trust: 1.53

sources: CNVD: CNVD-2014-06115 // CNNVD: CNNVD-201409-914 // BID: 69847 // IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-06115

AFFECTED PRODUCTS

vendor:trend micromodel:ossecscope:eqversion:2.8

Trust: 1.1

sources: IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-06115 // BID: 69847

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2014-06115
value: LOW

Trust: 0.6

IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d
value: LOW

Trust: 0.2

CNVD: CNVD-2014-06115
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-06115

THREAT TYPE

local

Trust: 0.9

sources: BID: 69847 // CNNVD: CNNVD-201409-914

TYPE

Design Error

Trust: 0.3

sources: BID: 69847

EXTERNAL IDS

db:BIDid:69847

Trust: 1.5

db:CNVDid:CNVD-2014-06115

Trust: 0.8

db:PACKETSTORMid:128261

Trust: 0.6

db:CNNVDid:CNNVD-201409-914

Trust: 0.6

db:IVDid:75C0336C-1EBA-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: 75c0336c-1eba-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-06115 // BID: 69847 // CNNVD: CNNVD-201409-914

REFERENCES

url:http://packetstormsecurity.com/files/128261/ossec-2.8-umask-clear-text-passwords.html

Trust: 0.6

url:http://www.securityfocus.com/bid/69847

Trust: 0.6

url: http://www.ossec.net/

Trust: 0.3

url:http://www.trendmicro.com/us/indexnight.html

Trust: 0.3

sources: CNVD: CNVD-2014-06115 // BID: 69847 // CNNVD: CNNVD-201409-914

CREDITS

Alejandro Ramos

Trust: 0.9

sources: BID: 69847 // CNNVD: CNNVD-201409-914

SOURCES

db:IVDid:75c0336c-1eba-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2014-06115
db:BIDid:69847
db:CNNVDid:CNNVD-201409-914

LAST UPDATE DATE

2022-05-17T01:41:18.966000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2014-06115date:2014-09-22T00:00:00
db:BIDid:69847date:2014-09-16T00:00:00
db:CNNVDid:CNNVD-201409-914date:2014-09-25T00:00:00

SOURCES RELEASE DATE

db:IVDid:75c0336c-1eba-11e6-abef-000c29c66e3ddate:2014-09-22T00:00:00
db:CNVDid:CNVD-2014-06115date:2014-09-22T00:00:00
db:BIDid:69847date:2014-09-16T00:00:00
db:CNNVDid:CNNVD-201409-914date:2014-09-25T00:00:00