CVE-2020-12831
LowSummary
In FRRouting (FRR) up to version 7.3.1, when using the split-config feature, the init script creates an empty config file with world-readable default permissions, potentially leading to information leakage via frr.in and frrcommon.sh.in tools.
Risk Assessment
The risk involves potential disclosure of sensitive network configuration data to unauthorized local users, which could facilitate attacks on routing infrastructure.
Recommendation
It is recommended to upgrade FRRouting to a version newer than 7.3.1 and manually set appropriate permissions (e.g., 600) for configuration files created by the init script.
Original NVD description (English source)
An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some pa