Test Kennung:	1.3.6.1.4.1.25623.1.0.112221
Kategorie:	Databases
Titel:	CouchDB 2.0.0 Privilege Escalation Vulnerability - Windows
Zusammenfassung:	Apache CouchDB is prone to a privilege escalation vulnerability.
Beschreibung:	Summary: Apache CouchDB is prone to a privilege escalation vulnerability. Vulnerability Insight: The Windows installer that the Apache CouchDB team provides is vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service launcher, or CouchDB batch or binary files. A subsequent service or server restart will then run that binary with administrator privilege. Affected Software/OS: Apache CouchDB version 2.0.0 on Windows Solution: Update to version 2.0.0.1 or later. NOTE: If an upgrade cannot be performed, the following steps will secure an existing CouchDB 2.0.0 installation: 1. In Windows Explorer, navigate to the CouchDB installation folder. Right click on the folder and select Properties. 2. In the Properties window, select the Security tab, and click on the Advanced button. 3. In the Advanced Security Settings window, click the Change Permissions... button. 4. Ensure only the following settings are listed, removing any other entries: - Allow - Users - Read & Execute - Allow - SYSTEM - Full control - Allow - Administrators - Full control 5. Check the "Replace all child object permissions with inheritable permissions from this object." 6. Click OK three times to close all dialog boxes. CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-8742 BugTraq ID: 94766 http://www.securityfocus.com/bid/94766 https://www.exploit-db.com/exploits/40865/ http://mail-archives.apache.org/mod_mbox/couchdb-dev/201612.mbox/%3C825F65E1-0E5F-4E1F-8053-CF2C6200C526%40apache.org%3E
Copyright	Copyright (C) 2018 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.