CVE-2014-4993 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Backup-Agoddard Project	Backup-Agoddard	3.0.28
Backup Checksum Project	Backup Checksum	3.0.23

Related Weaknesses (CWE)

CWE-200

References

http://www.openwall.com/lists/oss-security/2014/07/07/11Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/07/12Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing ListThird Party Advisory
http://www.vapid.dhs.org/advisories/backup-agoddard-3.0.28.htmlExploitThird Party Advisory
http://www.vapid.dhs.org/advisories/backup_checksum-3.0.23.htmlExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/07/11Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/07/12Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5Mailing ListThird Party Advisory
http://www.vapid.dhs.org/advisories/backup-agoddard-3.0.28.htmlExploitThird Party Advisory
http://www.vapid.dhs.org/advisories/backup_checksum-3.0.23.htmlExploitThird Party Advisory

FAQ

What is CVE-2014-4993?

CVE-2014-4993 is a vulnerability with a CVSS score of 7.8 (HIGH). (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows...

How severe is CVE-2014-4993?

CVE-2014-4993 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-4993?

Check the references section above for vendor advisories and patch information. Affected products include: Backup-Agoddard Project Backup-Agoddard, Backup Checksum Project Backup Checksum.