CVE-2010-2241 Information disclosure in n/a

Low 2.1 Published 17 Aug 2010 Updated 7 Aug 2024

Local attackers can read world-readable cache files to steal administrative passwords, leading to privilege escalation in Red Hat Directory Server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2010-2241?

CVE-2010-2241 is a low-severity vulnerability in n/a, published on 17 Aug 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts.

Weakness: CWE-264

Which versions are affected by CVE-2010-2241?

It affects 1 product.

Linux distribution packages (13)

`idm-console-framework` Red Hat:directory_server:8::el5	All versions	`0:1.1.5-1.el5idm`
`jss` Red Hat:directory_server:8::el5	All versions	`0:4.2.6-6.el5idm`
`jss-debuginfo` Red Hat:directory_server:8::el5	All versions	`0:4.2.6-6.el5idm`
`redhat-admin-console` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-2.el5dsrv`
`redhat-ds` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-2.el5dsrv`
`redhat-ds-admin` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-3.el5dsrv`
`redhat-ds-admin-debuginfo` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-3.el5dsrv`
`redhat-ds-base` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-13.el5dsrv`
`redhat-ds-base-debuginfo` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-13.el5dsrv`
`redhat-ds-base-devel` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-13.el5dsrv`
`redhat-ds-console` Red Hat:directory_server:8::el5	All versions	`0:8.2.0-4.el5dsrv`
`redhat-idm-console` Red Hat:directory_server:8::el5	All versions	`0:1.0.2-1.el5idm`
`redhat-idm-console-debuginfo` Red Hat:directory_server:8::el5	All versions	`0:1.0.2-1.el5idm`

Products include Redhat Directory Server.

How do I fix CVE-2010-2241?

Upgrade to a fixed version.

Is CVE-2010-2241 being exploited?

There is no known exploitation of CVE-2010-2241 in the wild and no public exploit code.

Sources

Also known as GHSA-g8wm-c6h5-35rm, RHSA-2010:0590.