CVE-2014-0164 in openshift
Summary
by MITRE
openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/12/2026
The vulnerability identified as CVE-2014-0164 affects the Red Hat OpenShift Enterprise platform, specifically within the openshift-origin-broker-util component that serves as a critical infrastructure element for managing application deployments and orchestration tasks. This security flaw manifests through improper file permission settings that create an exploitable condition allowing unauthorized local access to sensitive configuration data. The affected versions include OpenShift Enterprise 1.2.7 and 2.0.5, where the mcollective client.cfg file is configured with world-readable permissions, fundamentally undermining the security posture of the platform's credential management system.
The technical implementation of this vulnerability stems from the misconfiguration of file access controls within the broker utility component. The mcollective client.cfg file contains critical authentication credentials and configuration parameters necessary for system communication and orchestration functions. When this file is set with world-readable permissions, any local user account on the system can access its contents without authentication requirements. This configuration error directly violates fundamental security principles of least privilege and proper access control enforcement, creating an information disclosure vulnerability that exposes sensitive operational data to unauthorized parties.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attack vectors. Local attackers who gain access to the credentials stored in the mcollective client.cfg file could leverage this information to perform unauthorized system operations, escalate privileges, or establish persistent access to the OpenShift platform. The exposure of authentication credentials creates opportunities for lateral movement within the system and could potentially allow attackers to compromise additional services or applications that rely on the same credential stores. This vulnerability particularly affects environments where multiple users share the same system resources or where privilege escalation attacks are possible.
Security professionals should recognize this issue as a classic example of improper file permissions that aligns with CWE-732, which describes inadequate permissions for critical security resources. The vulnerability demonstrates weaknesses in the principle of least privilege enforcement and highlights the importance of proper access control implementation in distributed systems. From an ATT&CK framework perspective, this vulnerability corresponds to techniques involving privilege escalation and credential access, specifically targeting the T1078 and T1552 categories. Organizations should implement immediate remediation measures including proper file permission adjustments, regular security audits of configuration files, and comprehensive monitoring for unauthorized file access attempts. The recommended mitigation involves setting appropriate file permissions to restrict access to only authorized system processes and administrative users while maintaining proper logging and alerting mechanisms to detect potential exploitation attempts.