CVE-2016-6829 Hardcoded credentials in n/a
The Trove service user in the Crowbar Framework for OpenStack has a default password, allowing remote attackers to gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6829?
CVE-2016-6829 is a critical vulnerability in n/a, published on 9 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Weakness: CWE-798
Which versions are affected by CVE-2016-6829?
It affects 2 products.
Linux distribution packages (1)
crowbar-barclamp-trove SUSE:OpenStack Cloud 5 | All versions | 1.9+git.1473844105.932298f-9.1 |
Products include Barclamp-Trove Project Barclamp-Trove, Crowbar-Openstack Project Crowbar-Openstack.
How do I fix CVE-2016-6829?
Apply the vendor's patch.
Is CVE-2016-6829 being exploited?
There is no known exploitation of CVE-2016-6829 in the wild and no public exploit code.
Sources
Also known as GHSA-76r2-4vm6-wfmw, SUSE-SU-2016:3056-1.