CVE-2016-5411
CriticalSummary
The engine-DC-config.py script in Red Hat QuickStart Cloud Installer (QCI) before version 1.0 GA is world readable and contains the root password of the deployed system.
Risk Assessment
The availability of the root password file to all users poses a serious risk of unauthorized access to the system, potentially leading to a takeover of the infrastructure.
Recommendation
It is recommended to restrict permissions on the engine-DC-config.py file and to remove or secure the root password in another way.
Other vulnerabilities in Red Hat QuickStart Cloud Installer (QCI)
See all- CVE-2016-6340High
The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces the use of MD5 passwords on deployed systems, making it easier for attackers to determine cleartext passwords via a brute-force attack.
- CVE-2016-6322High
Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for the /etc/qci/answers file, allowing local users to obtain the root password for the deployed system by reading the file.
Original NVD description (English source)
/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system.