NVD

Id
17954  
Name
CVE-2016-1601  
Description
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-04-26  
Modified Date
2016-11-30  
Seq
2016-1601  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
98278 17954 CVE-2016-1601 SUSE-SU-2016:1138  View
98279 17954 CVE-2016-1601 openSUSE-SU-2016:1226  View
98280 17954 CVE-2016-1601 https://bugzilla.suse.com/show_bug.cgi?id=974220  View
98281 17954 CVE-2016-1601 https://build.opensuse.org/request/show/388020  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1929 JVNDB-2016-002702 SUSE Linux Enterprise で使用される yast2-users における脆弱性 SUSE Linux Enterprise で使用される yast2-users は、プロファイルが inst-sys ユーザを含まない場合、AutoYaST のインストール時に /etc/shadow の空のパスワードフィールドを適切に設定しないため、不特定の影響を受ける脆弱性が存在します。 CVE-2016-1601 88107 CVE-2016-1601 17954 10 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002702.html 2016-04-25 2016-05-17 View