CVE-2013-4216: Low severity intel wimax network service vulnerability
In InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c, function TraceOpenLogFile, the log file (typically /var/log/wimax/wimaxd.log) is chmod'ed to 0666. Log files should not be world-writable. I'm not sure if this log file should even be world-readable (see bug 911121).
It's probably best to restrict permissions on the /var/log/wimax directory, too.
Other sources
The TraceOpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses world-writable permissions for wimaxd.log, which allows local users to cause a denial of service (data corruption) by modifying this file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4216?
CVE-2013-4216 has a medium severity rating due to the potential exposure of sensitive log information.
How do I fix CVE-2013-4216?
You can fix CVE-2013-4216 by changing the permissions of the log file to remove world-writable access, ideally to 0644.
Which software is affected by CVE-2013-4216?
CVE-2013-4216 affects Intel WiMAX Network Service versions up to 1.5.2 and specifically version 1.5.0.
What type of vulnerability is CVE-2013-4216?
CVE-2013-4216 is a permissions vulnerability that allows world-writable access to sensitive log files.
What is the potential impact of CVE-2013-4216?
The potential impact of CVE-2013-4216 includes unauthorized access to sensitive information stored in log files.