CVE-2016-9639 Salt allows deleted minions to read or write to minions with the same id
Deleted minions can read or write to active minions with the same ID due to improper caching, allowing unauthorized data access and modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9639?
CVE-2016-9639 is a critical missing authorization vulnerability in Saltstack Salt, published on 7 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
Weakness: CWE-284
Which versions are affected by CVE-2016-9639?
3 open source packages ship an affected version, including salt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | All versions | 2015.8.11 |
salt PyPI | All versions | 2015.8.11 |
salt PyPI | All versions | 2015.8.11 |
Linux distribution packages (14)
salt SUSE:Enterprise Storage 3 | All versions | 2015.8.12-27.5 |
salt SUSE:Enterprise Storage 4 | All versions | 2015.8.12-27.5 |
salt SUSE:Linux Enterprise Point of Sale 12 SP2 | All versions | 2015.8.12-27.5 |
osad SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS | All versions | 5.11.64.3-5.1 |
salt SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS | All versions | 2015.8.12-27.1 |
spacewalk-backend SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS | All versions | 2.5.24.7-16.1 |
supportutils-plugin-susemanager-client SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS | All versions | 3.0.5-5.1 |
osad SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS | All versions | 5.11.64.3-5.1 |
salt SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS | All versions | 2015.8.12-27.1 |
spacewalk-backend SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS | All versions | 2.5.24.7-16.1 |
supportutils-plugin-susemanager-client SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS | All versions | 3.0.5-5.1 |
salt SUSE:Manager Client Tools 12 | All versions | 2015.8.12-27.5 |
salt SUSE:Manager Proxy 3.0 | All versions | 2015.8.12-27.5 |
salt SUSE:Manager Server 3.0 | All versions | 2015.8.12-27.5 |
Products include Saltstack Salt.
How do I fix CVE-2016-9639?
Upgrade salt to 2015.8.11 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-9639 being exploited?
There is no known exploitation of CVE-2016-9639 in the wild and no public exploit code.
Other vulnerabilities in Saltstack Salt
- CVE-2013-4437 SaltStack insecurely uses /tmp
- CVE-2013-6617 SaltStack Privilege Escalation vulnerability
- CVE-2021-33226 Code injection in n/a
- CVE-2021-25315 salt-api unauthenticated remote code execution
- CVE-2018-15751 SaltStack Salt Remote command execution and incorrect access control when using salt-api
Sources
Also known as GHSA-hvmj-356c-gpf4, PYSEC-2017-34, SUSE-RU-2017:0169-1, SUSE-RU-2017:0171-1, SUSE-RU-2017:0174-1, UBUNTU-CVE-2016-9639.