CVE-2013-3709: High severity suse lifecycle management server vulnerability
Published Dec 23, 2013
·Updated
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
Affected Software
3 affected components
Novell Suse Lifecycle Management Server=1.3
SUSE Studio onsite=1.3
SUSE WebYaST=1.3
Event History
Dec 23, 2013
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3709?
CVE-2013-3709 is classified as a high severity vulnerability due to its potential for privilege escalation.
2
How do I fix CVE-2013-3709?
To fix CVE-2013-3709, you need to change the file permissions on config/initializers/secret_token.rb to restrict access.
3
Who is affected by CVE-2013-3709?
CVE-2013-3709 affects local users of SUSE Lifecycle Management Server, SUSE Studio Onsite, and Novell WebYaST Appliance version 1.3.
4
What is CVE-2013-3709?
CVE-2013-3709 is a vulnerability in WebYaST 1.3 that allows local users to read the Rails secret token due to weak file permissions.
5
Can CVE-2013-3709 be exploited remotely?
No, CVE-2013-3709 requires local access to exploit the vulnerability.