CVE-2014-4995

Name of the Vulnerable Software and Affected Versions VladTheEnterprising gem version 0.2

Description The issue allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed, due to a race condition in the lib/vlad/dba/mysql.rb file.

Recommendations For version 0.2 of the VladTheEnterprising gem, consider restricting access to the temporary files created by the lib/vlad/dba/mysql.rb file until a patch is available. As a temporary workaround, avoid using the vulnerable function in lib/vlad/dba/mysql.rb that handles the MySQL root password. At the moment, there is no information about a newer version that contains a fix for this vulnerability.