Bug 1088732 (CVE-2014-0189)

Summary:	CVE-2014-0189 virt-who: plaintext hypervisor passwords in world-readable /etc/sysconfig/virt-who configuration file
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bressers, castigliones, jkurik, jrusnack, kshirsal, nshaik, pfrields, rbalakri, rnovacek, security-response-team, wlehman
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that the /etc/sysconfig/virt-who configuration file, which may contain hypervisor authentication credentials, was world-readable. A local user could use this flaw to obtain authentication credentials from this file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-06 10:25:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1088756, 1158759, 1186034
Bug Blocks:	1088733, 1121513

Description Murray McAllister 2014-04-17 04:43:08 UTC

It was reported that "/etc/sysconfig/virt-who" is world-readable and contains plaintext passwords to connect to various hypervisors. A local attacker could use this flaw to obtain those passwords and gain access to the hypervisors.

Comment 4 Radek Novacek 2014-04-17 06:27:19 UTC

Thanks for the report. Bug 1081286 is also complaint about having unencrypted passwords in world-readable files.

I'll make the file root readable only, but is it enough? I don't see any solution how virt-who can unencrypt password from configuration file.

Virt-who has to operate unattended, so asking for password is not an option. If virt-who has encrypting key somewhere (disk, source code) what will prevent attacker to read it anyway? It would be just security through obscurity.

I'm open to suggestions how to fix it.

Comment 5 Murray McAllister 2014-04-24 05:37:16 UTC

Acknowledgements:

Red Hat would like to thank Sal Castiglione for reporting this issue.

Comment 8 Murray McAllister 2014-04-28 02:11:58 UTC

Public already via https://bugzilla.redhat.com/show_bug.cgi?id=1081286

Comment 16 Radek Novacek 2015-01-26 12:28:49 UTC

Again, this bug is not about plain text versus encrypted passwords, but about wrong permissions for file with passwords.

Comment 18 Tomas Hoger 2015-01-26 20:41:59 UTC

This issue was already addressed in the virt-who updates for Red Hat Enterprise Linux 5 (released as part of Red Hat Enterprise Linux 5.11) and Red Hat Enterprise Linux 6 (released as part of Red Hat Enterprise Linux 6.6) by changing permissions of the /etc/sysconfig/virt-who configuration file to 600, i.e. making the file only readable to the administrative user.

https://rhn.redhat.com/errata/RHBA-2014-1206.html
https://rhn.redhat.com/errata/RHBA-2014-1513.html

Similar change is expected to be included in future updates for Red Hat Enterprise Linux 7.

Comment 19 Tomas Hoger 2015-01-26 21:22:33 UTC

Created virt-who tracking bugs for this issue:

Affects: fedora-all [bug 1186034]

Comment 20 Fedora Update System 2015-02-15 03:23:57 UTC

virt-who-0.8-11.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 21 errata-xmlrpc 2015-03-05 10:23:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0430 https://rhn.redhat.com/errata/RHSA-2015-0430.html