CVE-2000-0361: Low severity SUSE SuSE Linux vulnerability

Published Dec 14, 1999

Updated

The PPP wvdial.lxdialog script in wvdial 1.4 and earlier creates a .config file with world readable permissions, which allows a local attacker in the dialout group to access login and password information.

Affected Software

1 affected component

SUSE SuSE Linux

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove wvdial from your environment.
If wvdial is not required, uninstall the package from affected SUSE systems to eliminate the vulnerable component.
Configuration
Modify wvdial.lxdialog so the .config file is created with restrictive permissions (not world-readable). Implement a restrictive umask (for example umask 0077) or explicitly chmod the .config file to owner-only immediately after creation.
wvdial (wvdial.lxdialog) .config file creation permissions / umask = not world-readable (e.g. restrict to owner only)
Compensating control
Restrict membership of the dialout group to trusted users only and/or restrict local access to systems where wvdial is installed so untrusted local accounts cannot read user configuration files.
Operational
Assume credentials stored in any world-readable .config files may have been exposed; rotate affected login/password credentials after securing file permissions or removing the vulnerable component.

Event History

Dec 14, 1999

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Jul 12, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0361?

The severity of CVE-2000-0361 is considered low, mainly affecting local attackers.

How do I fix CVE-2000-0361?

To fix CVE-2000-0361, you should ensure that the .config file created by wvdial has proper permissions set to restrict access.

What type of vulnerability is CVE-2000-0361?

CVE-2000-0361 is a local information disclosure vulnerability due to improper file permissions.

Who is affected by CVE-2000-0361?

Users in the dialout group can be affected by CVE-2000-0361 if they have access to the world-readable .config file.

What software versions are vulnerable to CVE-2000-0361?

Wvdial versions 1.4 and earlier are vulnerable to CVE-2000-0361.