SecurityTracker.com Archives - Sysreport May Disclose the up2date Proxy Password Via the System Report

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker
Archives

Sign Up

Instant Alerts

Buy our Premium Vulnerability Notification Service to receive customized, instant alerts

Affiliates

Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!

Partners

Become a Partner and License Our Database or Notification Service

Report a Bug

Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com

Category: Application (Generic) > Sysreport

Vendors: Red Hat

Sysreport May Disclose the up2date Proxy Password Via the System Report

SecurityTracker Alert ID: 1014181

SecurityTracker URL: http://securitytracker.com/id?1014181

CVE Reference: CVE-2005-1760 (Links to External Site)

Updated: Aug 12 2008

Original Entry Date: Jun 13 2005

Impact: Disclosure of authentication information

Fix Available: Yes Vendor Confirmed: Yes

Advisory: Red Hat Advisory

Description: A vulnerability was reported in Sysreport. The system may disclose a proxy server password in the system report.

When the root user runs Sysreport, the contents of the '/etc/sysconfig/rhn/up2date' configuration file are included. If up2date is configured to connect to a proxy server using an authentication password, the plain text password is visible in the system report.

Impact: A user viewing the system report can obtain the proxy password.

Vendor URL: www.ibiblio.org/shadow/sysreport/ (Links to External Site)

Cause: Access control error

Underlying OS: Linux (Red Hat Enterprise)

Underlying OS Comments: 2.1, 3, 4

Reported By: bugzilla@redhat.com

Message History: None.

Source Message Contents

Date: Mon, 13 Jun 2005 08:40 -0400
From: bugzilla@redhat.com
Subject: [RHSA-2005:502-01] Moderate: sysreport security update

 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: sysreport security update
Advisory ID:       RHSA-2005:502-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2005-502.html
Issue date:        2005-06-13
Updated on:        2005-06-13
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2005-1760
- ---------------------------------------------------------------------

1. Summary:

An updated sysreport package that fixes an information disclosure flaw is
now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - noarch
Red Hat Linux Advanced Workstation 2.1 - noarch
Red Hat Enterprise Linux ES version 2.1 - noarch
Red Hat Enterprise Linux WS version 2.1 - noarch
Red Hat Enterprise Linux AS version 3 - noarch
Red Hat Desktop version 3 - noarch
Red Hat Enterprise Linux ES version 3 - noarch
Red Hat Enterprise Linux WS version 3 - noarch
Red Hat Enterprise Linux AS version 4 - noarch
Red Hat Enterprise Linux Desktop version 4 - noarch
Red Hat Enterprise Linux ES version 4 - noarch
Red Hat Enterprise Linux WS version 4 - noarch

3. Problem description:

Sysreport is a utility that gathers information about a system's hardware
and configuration. The information can then be used for diagnostic purposes
and debugging.

When run by the root user, sysreport includes the contents of the
/etc/sysconfig/rhn/up2date configuration file.  If up2date has been
configured to connect to a proxy server that requires an authentication
password, that password is included in plain text in the system report. 
The Common Vulnerabilities and Exposures project assigned the name
CAN-2005-1760 to this issue.

Users of sysreport should update to this erratum package, which contains a
patch that removes any proxy authentication passwords.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

159502 - CAN-2005-1760 sysreport includes proxy password in cleartext


6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/sysreport-1.3.7.0-4.src.rpm
ee0162efdf945753f3870eabbd6f2ace  sysreport-1.3.7.0-4.src.rpm

noarch:
877c7a9ce70dc7f83852485666cd7b81  sysreport-1.3.7.0-4.noarch.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/sysreport-1.3.7.0-4.src.rpm
ee0162efdf945753f3870eabbd6f2ace  sysreport-1.3.7.0-4.src.rpm

noarch:
877c7a9ce70dc7f83852485666cd7b81  sysreport-1.3.7.0-4.noarch.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/sysreport-1.3.7.0-4.src.rpm
ee0162efdf945753f3870eabbd6f2ace  sysreport-1.3.7.0-4.src.rpm

noarch:
877c7a9ce70dc7f83852485666cd7b81  sysreport-1.3.7.0-4.noarch.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/sysreport-1.3.7.0-4.src.rpm
ee0162efdf945753f3870eabbd6f2ace  sysreport-1.3.7.0-4.src.rpm

noarch:
877c7a9ce70dc7f83852485666cd7b81  sysreport-1.3.7.0-4.noarch.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/sysreport-1.3.7.2-6.src.rpm
3d862802529be0c1751719fcc0769460  sysreport-1.3.7.2-6.src.rpm

noarch:
cb23bfbecf4a03066410253fed765549  sysreport-1.3.7.2-6.noarch.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/sysreport-1.3.7.2-6.src.rpm
3d862802529be0c1751719fcc0769460  sysreport-1.3.7.2-6.src.rpm

noarch:
cb23bfbecf4a03066410253fed765549  sysreport-1.3.7.2-6.noarch.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/sysreport-1.3.7.2-6.src.rpm
3d862802529be0c1751719fcc0769460  sysreport-1.3.7.2-6.src.rpm

noarch:
cb23bfbecf4a03066410253fed765549  sysreport-1.3.7.2-6.noarch.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/sysreport-1.3.7.2-6.src.rpm
3d862802529be0c1751719fcc0769460  sysreport-1.3.7.2-6.src.rpm

noarch:
cb23bfbecf4a03066410253fed765549  sysreport-1.3.7.2-6.noarch.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/sysreport-1.3.15-2.src.rpm
776bab105ff07f51652caab88d1d6597  sysreport-1.3.15-2.src.rpm

noarch:
ec397dff4766feb681352573cb105db8  sysreport-1.3.15-2.noarch.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/sysreport-1.3.15-2.src.rpm
776bab105ff07f51652caab88d1d6597  sysreport-1.3.15-2.src.rpm

noarch:
ec397dff4766feb681352573cb105db8  sysreport-1.3.15-2.noarch.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/sysreport-1.3.15-2.src.rpm
776bab105ff07f51652caab88d1d6597  sysreport-1.3.15-2.src.rpm

noarch:
ec397dff4766feb681352573cb105db8  sysreport-1.3.15-2.noarch.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/sysreport-1.3.15-2.src.rpm
776bab105ff07f51652caab88d1d6597  sysreport-1.3.15-2.src.rpm

noarch:
ec397dff4766feb681352573cb105db8  sysreport-1.3.15-2.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1760

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCrX51XlSAg2UNWIIRAm0vAKDDc30VCnWAzZOAIx5kx9fKuBhy6ACfTZ7s
FLSUafsoO7crDCfOpbUl/zY=
=5szo
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

Go to the Top of This SecurityTracker Archive Page

Home | View Topics | Search | Contact Us | Help
Copyright 2007, SecurityGlobal.net LLC