World-Readable Permissions in Ceph-Deploy Affects Admin Keyring Access
CVE-2015-4053

Currently unrated

Key Information:

Vendor: Ceph
Status: Ceph-deploy
Vendor: CVE Published:; 8 June 2015

What is CVE-2015-4053?

Ceph-deploy versions prior to 1.5.25 have a vulnerability that results from insecure permissions on the /etc/ceph/ceph.client.admin.keyring file. This makes it accessible to all local users, enabling them to read sensitive information that should be restricted. This design flaw highlights the importance of implementing proper file permission controls to prevent unauthorized access to critical security credentials.

References

http://www.securityfocus.com/bid/74775

vdb-entryx_refsource_BID

http://www.openwall.com/lists/oss-security/2015/04/09/9

mailing-listx_refsource_MLIST

http://www.openwall.com/lists/oss-security/2015/05/22/1

mailing-listx_refsource_MLIST

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 8, 2015
Vulnerability Reserved
May 21, 2015

CVE-2015-4053 Data

JSON