Anaconda Bootloader Configuration Module Insecure File Permission Vulnerability

Bugtraq ID:	53486
Class:	Design Error
CVE:	CVE-2012-2314
Remote:	No
Local:	Yes
Published:	May 10 2012 12:00AM
Updated:	Apr 13 2015 10:05PM
Credit:	Red Hat
Vulnerable:	Anaconda Anaconda 0
Not Vulnerable:

Anaconda Bootloader Configuration Module Insecure File Permission Vulnerability

Anaconda is prone to an insecure file-permission security issue that affects its bootloader configuration module.

An attacker can exploit this issue to obtain sensitive information that can aid in further attacks.

Anaconda Bootloader Configuration Module Insecure File Permission Vulnerability

Attackers with local access can use readily available tools and standard commands to exploit this issue.

Anaconda Bootloader Configuration Module Insecure File Permission Vulnerability

Solution:
Updates are available. Please see the references for more information.

Anaconda Bootloader Configuration Module Insecure File Permission Vulnerability

References:

• Anaconda Homepage (Anaconda)
  
• Bug 819031 - (CVE-2012-2314) CVE-2012-2314 anaconda: Weak permissions by writing (Red Hat)
  
• Fix the permissions on one of the files we write out. (#817171) (Peter Jones)