CVE-2016-6494: Infoleak
First published: Fri Jul 29 2016(Updated: )
It was found that MongoDB creates a world-readable .dbshell history file in a user's directory: The mongodb client doesn't store authentication commands, but there's still information leakage, though, even if only about database and collection names, or data structure. As for data itself, the history could also contain sensitive information; for instance, if usernames for some other service were stored in a mongo collection, the history could contain lines like: db.users.find({user:"foo"}) or even: db.users.update({user:"foo"},{$set:{password:"OhComeOnNow"}}) Upstream bug (closed as "Works as Designed"): <a href="https://jira.mongodb.org/browse/SERVER-25335">https://jira.mongodb.org/browse/SERVER-25335</a> CVE request: <a href="http://seclists.org/oss-sec/2016/q3/199">http://seclists.org/oss-sec/2016/q3/199</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/mongodb | <=1:2.4.10-5 | 1:2.6.12-3 1:3.2.11-1 1:2.4.10-5+deb8u1 |
| debian/2.0.6-1 | <=undefined | |
| debian/2.4.10-5 | <=undefined | |
| debian/mongodb | ||
| MongoDB | <3.0.15 | |
| MongoDB | >=3.2<3.2.14 | |
| MongoDB | >=3.3<3.3.14 | |
| Fedora | =25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.openwall.com/lists/oss-security/2016/07/29/4
- https://security-tracker.debian.org/tracker/CVE-2016-6494
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460
- https://jira.mongodb.org/browse/SERVER-25335
- https://jira.mongodb.org/browse/SERVER-25335#comment-1342085
- https://bugs.debian.org/398793
- https://bugs.debian.org/782001
- http://inguza.com/
- https://security-tracker.debian.org/tracker/TEMP-0833087-C5410D
- http://apt.inguza.net/wheezy-security/mongodb/mongodb.debdiff
- http://apt.inguza.net/wheezy-security/mongodb/
- https://groups.google.co
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908
- http://www.openwall.com/lists/oss-security/2016/07/29/4
- http://www.openwall.com/lists/oss-security/2016/07/29/8
- http://www.securityfocus.com/bid/92204
- https://bugzilla.redhat.com/show_bug.cgi?id=1362553
- https://github.com/mongodb/mongo/commit/035cf2afc04988b22cb67f4ebfd77e9b344cb6e0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MCE2ZLFBNOK3TTWSTXZJQGZVP4EEJDL/
- http://seclists.org/oss-sec/2016/q3/199
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362554
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362555
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362553#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362553#c0
Frequently Asked Questions
What is the severity of CVE-2016-6494?
CVE-2016-6494 is rated as a medium severity vulnerability due to potential information leakage from a world-readable .dbshell history file.
How do I fix CVE-2016-6494?
To fix CVE-2016-6494, you should upgrade to MongoDB versions 2.6.12-3, 3.2.11-1, or 2.4.10-5+deb8u1 where the issue is resolved.
Who is affected by CVE-2016-6494?
CVE-2016-6494 affects users of specific MongoDB versions that create world-readable .dbshell history files, potentially exposing sensitive information.
What versions of MongoDB are vulnerable to CVE-2016-6494?
MongoDB versions prior to 3.0.15 are vulnerable to CVE-2016-6494, particularly those in the 2.x series.
Is there a workaround for CVE-2016-6494 until I can upgrade?
A temporary workaround for CVE-2016-6494 is to change the permissions of the .dbshell file to restrict access, though upgrading is recommended.
- agent/type
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-6494
- agent/references
- agent/last-modified-date
- agent/event
- collector/debian-bugs
- source/Debian
- agent/software-canonical-lookup
- collector/security-tracker-debian
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/mongodb
- canonical/mongodb
- version/mongodb/3.2
- version/mongodb/3.3
- vendor/fedoraproject
- canonical/fedora
- version/fedora/25