Augeas CVE-2013-6412 Insecure File Permissions Vulnerability

Bugtraq ID:	65165
Class:	Design Error
CVE:	CVE-2013-6412
Remote:	No
Local:	Yes
Published:	Jan 27 2014 12:00AM
Updated:	Apr 13 2015 09:50PM
Credit:	Red Hat Security Response Team
Vulnerable:	Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 CentOS CentOS 6 Augeas augeas 1.1.0 Augeas augeas 1.0.0
Not Vulnerable:

Augeas CVE-2013-6412 Insecure File Permissions Vulnerability

Augeas is prone to an insecure file-permission vulnerability.

A local attacker can exploit this issue to obtain potentially sensitive information and overwrite certain files. Information obtained may aid in further attacks

Augeas 1.0.0 through 1.1.0 are vulnerable; other versions may also be affected.

Augeas CVE-2013-6412 Insecure File Permissions Vulnerability

Attackers can use readily available tools and standard commands to exploit this issue.

Augeas CVE-2013-6412 Insecure File Permissions Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva augeas-1.1.0-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva augeas-lenses-1.1.0-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64augeas-devel-1.1.0-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64augeas0-1.1.0-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64fa1-1.1.0-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Augeas CVE-2013-6412 Insecure File Permissions Vulnerability

References:

• Eventum HomePage (Augeas)