CVE-2016-1601: Critical severity suse yast vulnerability

Published Apr 26, 2016

Updated

yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.

Affected Software

4 affected components

SUSE yast2

SUSE Linux Enterprise Desktop=12-sp1

SUSE Linux Enterprise Server=12-sp1

SUSE Linux Enterprise Software Development Kit=12-sp1

Event History

Apr 26, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1601?

CVE-2016-1601 has not been assigned a specific severity rating, but it can lead to unauthorized access due to improperly set empty password fields.

How do I fix CVE-2016-1601?

To fix CVE-2016-1601, update to a version of yast2 that is 3.1.47 or later.

Which software versions are affected by CVE-2016-1601?

CVE-2016-1601 affects yast2 versions before 3.1.47 on SUSE Linux Enterprise 12 SP1.

What can attackers exploit in CVE-2016-1601?

Attackers could potentially exploit CVE-2016-1601 to gain unauthorized access through undefined vectors due to misconfigured password fields.

Is CVE-2016-1601 still a risk if I have updated my system?

If your system has been updated to yast2 version 3.1.47 or later, CVE-2016-1601 should no longer be a risk.