CVE-2007-5686 - Vulnerability Details - OpenCVE

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Rpath	Rpath Linux

Configuration 1 [-]

cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.spirityenterprise.com/managed-detection-response
https://www.spirityenterprise.com/managed-detection-response-microsoft
https://www.spirityenterprise.com/mdr-for-splunk
http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-28T16:00:00.000Z

Updated: 2024-08-07T15:39:13.700Z

Reserved: 2007-10-28T00:00:00.000Z

Link: CVE-2007-5686

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-10-28T17:08:00.000

Modified: 2026-04-23T00:35:47.467

Link: CVE-2007-5686

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-11T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20071026 FLEA-2007-0060-1 initscripts", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://issues.rpath.com/browse/RPL-1825"}, {"name": "20071011 rPSA-2007-0214-1 initscripts", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"}, {"name": "ADV-2007-3474", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3474"}, {"name": "26048", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26048"}, {"name": "27215", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27215"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5686", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20071026 FLEA-2007-0060-1 initscripts", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"}, {"name": "https://issues.rpath.com/browse/RPL-1825", "refsource": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-1825"}, {"name": "20071011 rPSA-2007-0214-1 initscripts", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"}, {"name": "ADV-2007-3474", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3474"}, {"name": "26048", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26048"}, {"name": "27215", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27215"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:39:13.700Z"}, "title": "CVE Program Container", "references": [{"name": "20071026 FLEA-2007-0060-1 initscripts", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://issues.rpath.com/browse/RPL-1825"}, {"name": "20071011 rPSA-2007-0214-1 initscripts", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"}, {"name": "ADV-2007-3474", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3474"}, {"name": "26048", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26048"}, {"name": "27215", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27215"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5686", "datePublished": "2007-10-28T16:00:00.000Z", "dateReserved": "2007-10-28T00:00:00.000Z", "dateUpdated": "2024-08-07T15:39:13.700Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:*", "matchCriteriaId": "0DD12BC0-1E50-49C6-AD0D-8CE90F0E8449", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."}, {"lang": "es", "value": "initscripts en el rPath Linux 1 establece permisos inseguros para el fichero /var/log/btmp, lo que permite a usuarios locales obtener informaci\u00f3n sensible respecto a los intentos de autenticaci\u00f3n. NOTA: debido a que el sshd detecta los permisos inseguros y no registra ciertos eventos, esto tambi\u00e9n previene al sshd de registrar intentos fallidos de autenticaci\u00f3n por usuarios remotos."}], "id": "CVE-2007-5686", "lastModified": "2026-04-23T00:35:47.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-28T17:08:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/27215"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26048"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/3474"}, {"source": "cve@mitre.org", "url": "https://issues.rpath.com/browse/RPL-1825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/27215"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26048"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3474"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://issues.rpath.com/browse/RPL-1825"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}