CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

CVSS v3.0 7.8 HIGH
CVSS v2.0 2.1 LOW

7.8^/10

CVSS v3.0 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658	Issue Tracking Patch Third Party Advisory
https://github.com/saltstack/salt/pull/40609	Issue Tracking Patch Third Party Advisory
https://github.com/saltstack/salt/issues/40075	Issue Tracking Patch Third Party Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html	Patch Release Notes Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1035912	Issue Tracking Patch
http://www.securityfocus.com/bid/98095	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:saltstack:salt:2016.11.2:::::::*
	cpe:2.3:a:saltstack:salt:2016.11.0:rc2::::::
	cpe:2.3:a:saltstack:salt:2016.11.0:::::::*
	cpe:2.3:a:saltstack:salt:2016.11:::::::*
	cpe:2.3:a:saltstack:salt:2016.11.1:::::::*
	cpe:2.3:a:saltstack:salt:2016.11.3:::::::*
	cpe:2.3:a:saltstack:salt:2016.11.0:rc1::::::

Information

Published : 2017-04-25 10:59

Updated : 2017-05-05 10:58

NVD link : CVE-2017-8109

Mitre link : CVE-2017-8109

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

saltstack

salt

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658", "name": "https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/saltstack/salt/pull/40609", "name": "https://github.com/saltstack/salt/pull/40609", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/saltstack/salt/issues/40075", "name": "https://github.com/saltstack/salt/issues/40075", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html", "name": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=1035912", "name": "https://bugzilla.suse.com/show_bug.cgi?id=1035912", "tags": ["Issue Tracking", "Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/98095", "name": "98095", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-8109", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}}, "publishedDate": "2017-04-25T17:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.0:rc2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:saltstack:salt:2016.11.0:rc1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-05-05T17:58Z"}