CVE-2016-6494: Infoleak
First published: Fri Jul 29 2016(Updated: )
It was found that MongoDB creates a world-readable .dbshell history file in a user's directory: The mongodb client doesn't store authentication commands, but there's still information leakage, though, even if only about database and collection names, or data structure. As for data itself, the history could also contain sensitive information; for instance, if usernames for some other service were stored in a mongo collection, the history could contain lines like: db.users.find({user:"foo"}) or even: db.users.update({user:"foo"},{$set:{password:"OhComeOnNow"}}) Upstream bug (closed as "Works as Designed"): <a href="https://jira.mongodb.org/browse/SERVER-25335">https://jira.mongodb.org/browse/SERVER-25335</a> CVE request: <a href="http://seclists.org/oss-sec/2016/q3/199">http://seclists.org/oss-sec/2016/q3/199</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/mongodb | ||
| debian/mongodb | <=1:2.4.10-5 | 1:2.6.12-3 1:3.2.11-1 1:2.4.10-5+deb8u1 |
| debian/2.0.6-1 | ||
| debian/2.4.10-5 | ||
| MongoDB MongoDB | <3.0.15 | |
| MongoDB MongoDB | >=3.2<3.2.14 | |
| MongoDB MongoDB | >=3.3<3.3.14 | |
| Fedoraproject Fedora | =25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.openwall.com/lists/oss-security/2016/07/29/4
- https://security-tracker.debian.org/tracker/CVE-2016-6494
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460
- https://jira.mongodb.org/browse/SERVER-25335
- https://jira.mongodb.org/browse/SERVER-25335#comment-1342085
- https://bugs.debian.org/398793
- https://bugs.debian.org/782001
- http://inguza.com/
- https://security-tracker.debian.org/tracker/TEMP-0833087-C5410D
- http://apt.inguza.net/wheezy-security/mongodb/mongodb.debdiff
- http://apt.inguza.net/wheezy-security/mongodb/
- https://groups.google.co
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908
- http://www.openwall.com/lists/oss-security/2016/07/29/4
- http://www.openwall.com/lists/oss-security/2016/07/29/8
- http://www.securityfocus.com/bid/92204
- https://bugzilla.redhat.com/show_bug.cgi?id=1362553
- https://github.com/mongodb/mongo/commit/035cf2afc04988b22cb67f4ebfd77e9b344cb6e0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/
- http://seclists.org/oss-sec/2016/q3/199
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362554
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362555
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362553#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362553#c0
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-6494
- agent/references
- agent/last-modified-date
- agent/event
- collector/debian-bugs
- source/Debian
- agent/software-canonical-lookup
- agent/tags
- collector/security-tracker-debian
- vendor/mongodb
- canonical/mongodb mongodb
- version/mongodb mongodb/3.2
- version/mongodb mongodb/3.3
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/25
- package-manager/debian