Confd log files contain local users', including root’s,...
High severity
Unreviewed
Published
Mar 23, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Mar 22, 2022
Published to the GitHub Advisory Database
Mar 23, 2022
Last updated
Jan 27, 2023
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
References