Information disclosure in Novell SUSE Audit Log Keeper

CVE-2012-0421

The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file.

Vulnerability class: Information Disclosure

EPSS: 0.003 (24.5th percentile) — read the EPSS interpretation.

Affected products

Novell Suse_audit_log_keeper
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (vendor-advisory, x_refsource_SUSE, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM)