Description
The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.openwall.com/lists/oss-security/2012/07/30/7 ↗
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=dcd45fb6931c4abf710829bee21af09f842bc281 ↗
- https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=712813d3118a5b9e5a496179cab81dbe91f69d63 ↗
- http://www.openwall.com/lists/oss-security/2012/07/30/6 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78874 ↗
- https://git.icinga.org/?p=icinga-doc.git%3Ba=commitdiff%3Bh=619a08ca1178144b8a3a5caafff32a2d3918edab ↗
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00012.html ↗
- https://bugzilla.novell.com/show_bug.cgi?id=767319 ↗