CVE-2013-4216
First published: Thu Feb 14 2013(Updated: )
In InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c, function Trace_OpenLogFile, the log file (typically /var/log/wimax/wimaxd.log) is chmod'ed to 0666. Log files should not be world-writable. I'm not sure if this log file should even be world-readable (see <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED EOL - CVE-2013-4217 wimax (OSAL crypt module): By setting encrypted password writes unencrypted passwords to log files" href="show_bug.cgi?id=911121">bug 911121</a>). It's probably best to restrict permissions on the /var/log/wimax directory, too.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel WiMAX Network Service | <=1.5.2 | |
| Intel WiMAX Network Service | =1.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=911121
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=995160
- http://www.openwall.com/lists/oss-security/2013/08/08/10
- https://access.redhat.com/security/cve/CVE-2013-4216
- http://www.openwall.com/lists/oss-security/2013/08/08/17
- https://bugzilla.redhat.com/show_bug.cgi?id=911122
Frequently Asked Questions
What is the severity of CVE-2013-4216?
CVE-2013-4216 has a medium severity rating due to the potential exposure of sensitive log information.
How do I fix CVE-2013-4216?
You can fix CVE-2013-4216 by changing the permissions of the log file to remove world-writable access, ideally to 0644.
Which software is affected by CVE-2013-4216?
CVE-2013-4216 affects Intel WiMAX Network Service versions up to 1.5.2 and specifically version 1.5.0.
What type of vulnerability is CVE-2013-4216?
CVE-2013-4216 is a permissions vulnerability that allows world-writable access to sensitive log files.
What is the potential impact of CVE-2013-4216?
The potential impact of CVE-2013-4216 includes unauthorized access to sensitive information stored in log files.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-4216
- agent/trending
- agent/tags
- agent/source
- vendor/intel
- canonical/intel wimax network service
- version/intel wimax network service/1.5.2
- version/intel wimax network service/1.5.0