Main Vulnerability Database Vulnerabilities #VU42394

Permissions, Privileges, and Access Controls in Salt - CVE-2013-6617

Published: November 5, 2013 / Updated: August 10, 2020

Vulnerability identifier: #VU42394

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-6617

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.

Affected software

Salt
Fedora
salt

How to mitigate CVE-2013-6617

Install update from vendor's website.

salt - addressed in versions 0.17.1-1.el5, 0.17.1-1.el6

External References

http://docs.saltstack.com/topics/releases/0.17.1.html

Related Security Bulletins