[ GLSA 201101-07 ] Prewikka: password disclosure

[GLSA]

Gentoo Linux Security Advisory

Title: Prewikka: password disclosure (GLSA 201101-07)
Severity: normal
Exploitable: local
Date: January 16, 2011
Bug(s): #270056
ID: 201101-07

Synopsis


Due to a world-readable file, a local attacker can obtain the SQL database
password used by Prewikka.


Background


Prewikka is a graphical front-end analysis console for the Prelude
Hybrid IDS Framework.


Affected Packages

Package: net-analyzer/prewikka
Vulnerable: < 0.9.14-r2
Unaffected: >= 0.9.14-r2
Architectures: All supported architectures


Description


The permissions of the prewikka.conf file are set world readable.


Impact


A local attacker could obtain the SQL database password used by
Prewikka.


Workaround


There is no known workaround at this time.


Resolution


All Prewikka users should upgrade to the latest version: