CVE-2016-5411

Critical

Published: 13/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The engine-DC-config.py script in Red Hat QuickStart Cloud Installer (QCI) before version 1.0 GA is world readable and contains the root password of the deployed system.

Risk Assessment

The availability of the root password file to all users poses a serious risk of unauthorized access to the system, potentially leading to a takeover of the infrastructure.

Recommendation

It is recommended to restrict permissions on the engine-DC-config.py file and to remove or secure the root password in another way.

Original NVD description (English source)

/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system.