CVE-2016-5432

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5432
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2016-1967.html Vendor Advisory
http://www.securityfocus.com/bid/92694
https://bugzilla.redhat.com/show_bug.cgi?id=1371428 Issue Tracking Patch Vendor Advisory
https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129 Patch
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:redhat:enterprise_virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:24

Type Values Removed Values Added
Summary It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provision*db” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such as passwords. The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-5432', 'name': 'https://access.redhat.com/security/cve/CVE-2016-5432', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1967', 'name': 'https://access.redhat.com/errata/RHSA-2016:1967', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 16:17

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-5432 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1967 -
Summary The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files. It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provision*db” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such as passwords.
Information

Published : 2016-10-03 18:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-5432

Mitre link : CVE-2016-5432

CVE.ORG link : CVE-2016-5432

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • enterprise_virtualization
CWE
CWE-532

Insertion of Sensitive Information into Log File