CVE-2013-3632

kochin · 14. November 2014

Saw this on the National Vulnerability Database.
https://web.nvd.nist.gov/view/…tail?vulnId=CVE-2013-3632

Has it been addressed?

ryecoaaron · 14. November 2014

That is a year old. Being able to execute commands as root by an authenticated user is a feature not vulnerability. A lot of cron jobs need to run as root for proper privileges.

davidh2k · 14. November 2014

http://bugtracker.openmediavault.org/view.php?id=907

Greetings
David

kochin · 16. November 2014

I am glad to hear that it's a non-issue. However, since this vulnerability info is on many sites and its wording vaguely suggests any authenticated user can run commands as root, I think it's necessary for OMV to set the record straight and put everyone's mind at ease.

votdev · 10. Januar 2018

Since openmediavault 0.5.32 it is possible to disable user root in cron jobs by setting the environment variable OMV_USERMGMT_ENUMERATE_USER_ROOT to FALSE in /etc/default/openmediavault. See https://github.com/openmediava…28d20248a6f7dd797db03967b.

Jetzt mitmachen!