Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-025:01 advisory.

    The luci packages contain a web-based high-availability cluster configuration application.
    Security issues fixed with this release:
     CVE-2013-4481     Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before     restricting the permissions, which allows local users to read the file and obtain sensitive information     such as authentication secrets.
     CVE-2013-4482     Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using     the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current     working directory or (2) its parent directories.
    Fixed bugs:
     Luci's capability to work with the full set of agents parameters has been restored. Configured fence     device parameters that were previously discarded now work as expected: this includes parameters for     cmd_prompt, login_timeout, power_timeout, retry_on, shell_timeout and delay.
     Luci's capability to work with the full set of fence devices. Previously, Dell iDRAC (idrac), HP iLO2     (ilo2), HP iLO3 (ilo3), and IBM Integrated Management Module (imm) devices or agents would not properly     work, nor would a cluster comprising them.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated luci packages that fix two security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Luci is a web-based high availability administration application.

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. (CVE-2013-4482)

A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file. (CVE-2013-4481)

These issues were discovered by Jan Pokorny of Red Hat.

These updated luci packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All luci users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing this update, the luci service will be restarted automatically.

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. (CVE-2013-4482)

A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file. (CVE-2013-4481)

After installing this update, the luci service will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:1603 advisory.

    Luci is a web-based high availability administration application.

    A flaw was found in the way the luci service was initialized. If a system     administrator started the luci service from a directory that was writable     to by a local user, that user could use this flaw to execute arbitrary code     as the root or luci user. (CVE-2013-4482)

    A flaw was found in the way luci generated its configuration file. The file     was created as world readable for a short period of time, allowing a local     user to gain access to the authentication secrets stored in the     configuration file. (CVE-2013-4481)

    These issues were discovered by Jan Pokorn of Red Hat.

    These updated luci packages include numerous bug fixes and two     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All luci users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements. After installing this update, the luci service will be     restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
290111	MiracleLinux 4 : luci-0.26.0-48.AXS4 (AXSA:2014-025:01)	Nessus	Miracle Linux Local Security Checks	high
79165	CentOS 6 : luci (CESA-2013:1603)	Nessus	CentOS Local Security Checks	medium
71195	Scientific Linux Security Update : luci on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71008	RHEL 6 : luci (RHSA-2013:1603)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-4481

medium

Tenable Plugins

high

medium

medium

high