CVE-2013-2069
livecd-tools: improper handling of passwords
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Red Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x before 18.16, and 19.x before 19.3, when a rootpw directive is not set in a Kickstart file, sets the root user password to empty, which allows local users to gain privileges.
Red Hat livecd-tools anterior a v13.4.4, v17.x anterior a v17.17, v18.x anterior a v18.16, y v19.x anterior a v19.3, cuando una directiva rootpw no se encuentra en un fichero Kickstart, asígna una contraseña vacía al usuario root permitiendo a usuarios locales obtener privilegios.
It was discovered that when used to create images, livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no 'rootpw' directive was used or when the 'rootpw --lock' directive was used within the Kickstart file, which could allow local users to gain access to the root account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-02-19 CVE Reserved
- 2013-05-23 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-798: Use of Hard-coded Credentials
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/05/23/2 | Mailing List |
|
| http://www.securityfocus.com/bid/60119 | Third Party Advisory | |
| https://aws.amazon.com/security/security-bulletins/red-hat-and-other-third-party-public-amis-security-concern | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/84488 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2013-0849.html | 2018-12-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=964299 | 2013-05-23 | |
| https://access.redhat.com/security/cve/CVE-2013-2069 | 2013-05-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Livecd-tools Search vendor "Redhat" for product "Livecd-tools" | < 13.4.4 Search vendor "Redhat" for product "Livecd-tools" and version " < 13.4.4" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Livecd-tools Search vendor "Redhat" for product "Livecd-tools" | >= 17.0 < 17.17 Search vendor "Redhat" for product "Livecd-tools" and version " >= 17.0 < 17.17" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Livecd-tools Search vendor "Redhat" for product "Livecd-tools" | >= 18.0 < 18.16 Search vendor "Redhat" for product "Livecd-tools" and version " >= 18.0 < 18.16" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Livecd-tools Search vendor "Redhat" for product "Livecd-tools" | >= 19.0 < 19.3 Search vendor "Redhat" for product "Livecd-tools" and version " >= 19.0 < 19.3" | - |
Affected
| ||||||