Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cryoserver_security_appliance | Cryoserver | 7.3.0 (including) | 7.3.0 (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.0-a (including) | 7.3.0-a (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.1 (including) | 7.3.1 (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.1-a (including) | 7.3.1-a (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.2 (including) | 7.3.2 (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.3 (including) | 7.3.3 (including) |
| Cryoserver_security_appliance | Cryoserver | 7.3.4 (including) | 7.3.4 (including) |