The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the administrator account.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Appliance_platform_agent | Rpath | 2 (including) | 2 (including) |
| Appliance_platform_agent | Rpath | 3 (including) | 3 (including) |
References
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0148
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42393
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42394
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0148
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42393
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42394