Vulnerability Details CVE-2006-6614
The save_log_local function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 20.9%
CVSS Severity
CVSS v2 Score 1.9
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644
- http://secunia.com/advisories/23330
- http://www.securityfocus.com/bid/21579
- http://www.vupen.com/english/advisories/2006/4995
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30892
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644
- http://secunia.com/advisories/23330
- http://www.securityfocus.com/bid/21579
- http://www.vupen.com/english/advisories/2006/4995
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30892
Products affected by CVE-2006-6614
-
cpe:2.3:a:thomas_lange:fully_automated_installation:2.1
-
cpe:2.3:a:thomas_lange:fully_automated_installation:3.1.2
-
cpe:2.3:o:debian:debian_linux:3.1