Description
Opsware Network Automation System (NAS) 6.0 installs /etc/init.d/mysql with insecure permissions, which allows local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql.
References
- 20060824 Re: Opsware NAS 6.0 reveals MySQL 'root' password mailing-list
- 20060724 Opsware NAS 6.0 reveals MySQL 'root' password mailing-list
- 19126 vdb-entry
- 1016566 vdb-entry
- 1289 third-party-advisory
- 21192 third-party-advisory
- nas-mysql-plaintext-password(27995) vdb-entry
- 20060727 Re: Opsware NAS 6.0 reveals MySQL 'root' password mailing-list