Description
Red Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x before 18.16, and 19.x before 19.3, when a rootpw directive is not set in a Kickstart file, sets the root user password to empty, which allows local users to gain privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://aws.amazon.com/security/security-bulletins/red-hat-and-other-third-party-public-amis-security-concern/ ↗
- http://www.securityfocus.com/bid/60119 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84488 ↗
- http://www.openwall.com/lists/oss-security/2013/05/23/2 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=964299 ↗
- http://rhn.redhat.com/errata/RHSA-2013-0849.html ↗