CVE-2016-6322
HighSummary
Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for the /etc/qci/answers file, allowing local users to obtain the root password for the deployed system by reading the file.
Risk Assessment
Local users can gain access to the root password, posing a serious security risk to the system and the data stored within it.
Recommendation
It is recommended to change the permissions of the /etc/qci/answers file to restrict access to authorized users only.
Other vulnerabilities in Red Hat QuickStart Cloud Installer (QCI)
See all- CVE-2016-6340High
The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces the use of MD5 passwords on deployed systems, making it easier for attackers to determine cleartext passwords via a brute-force attack.
- CVE-2016-5411Critical
The engine-DC-config.py script in Red Hat QuickStart Cloud Installer (QCI) before version 1.0 GA is world readable and contains the root password of the deployed system.
Original NVD description (English source)
Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root password for the deployed system by reading the file.