CVE-2006-6614: Low severity thomas lange fully automated installation vulnerability
The saveloglocal function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6614?
CVE-2006-6614 is classified as a medium severity vulnerability due to the exposure of sensitive password information.
How do I fix CVE-2006-6614?
To fix CVE-2006-6614, it is recommended to modify the logging configuration to disable verbose mode or secure the permissions on the log files.
Which software versions are affected by CVE-2006-6614?
CVE-2006-6614 affects Fully Automated Installation versions 2.10.1 and possibly 3.1.2 as well as Debian Linux 3.1.
What type of attack can exploit CVE-2006-6614?
CVE-2006-6614 can be exploited by an attacker who gains access to the log files that contain the root password hash.
Is CVE-2006-6614 a common vulnerability?
CVE-2006-6614 is a recognized vulnerability primarily associated with older versions of Fully Automated Installation and Debian Linux.