CVE-2008-5103

2008-11-1718:18:48

CWE-255

[email protected]

web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

45.4%

JSON

The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.

Affected configurations

Nvd

Node

dcgrendelvmbuilderMatch0.9

AND

ubuntuubuntu_linuxMatch6.06_nil_lts

ubuntuubuntu_linuxMatch7.10

ubuntuubuntu_linuxMatch8.04_nil_lts

ubuntuubuntu_linuxMatch8.10

VendorProductVersionCPE
dcgrendelvmbuilder0.9cpe:2.3:a:dcgrendel:vmbuilder:0.9:*:*:*:*:*:*:*
ubuntuubuntu_linux6.06cpe:2.3:o:ubuntu:ubuntu_linux:6.06:_nil_:lts:*:*:*:*:*
ubuntuubuntu_linux7.10cpe:2.3:o:ubuntu:ubuntu_linux:7.10:*:*:*:*:*:*:*
ubuntuubuntu_linux8.04cpe:2.3:o:ubuntu:ubuntu_linux:8.04:_nil_:lts:*:*:*:*:*
ubuntuubuntu_linux8.10cpe:2.3:o:ubuntu:ubuntu_linux:8.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dcgrendel	vmbuilder	0.9	cpe:2.3:a:dcgrendel:vmbuilder:0.9:::::::*
ubuntu	ubuntu_linux	6.06	cpe:2.3:o:ubuntu:ubuntu_linux:6.06:_nil_:lts:::::*
ubuntu	ubuntu_linux	7.10	cpe:2.3:o:ubuntu:ubuntu_linux:7.10:::::::*
ubuntu	ubuntu_linux	8.04	cpe:2.3:o:ubuntu:ubuntu_linux:8.04:_nil_:lts:::::*
ubuntu	ubuntu_linux	8.10	cpe:2.3:o:ubuntu:ubuntu_linux:8.10:::::::*