Bug 1349136 (CVE-2016-4996)

Summary:	CVE-2016-4996 foreman: inside discovery-debug, the root password is displayed in plaintext
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cbillett, ceph-eng-bugs, jmatthew, lzap, mmccune, ohadlevy, satellite6-bugs, sisharma, tcarlin, tlestach, tsanders
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in discovery-debug in foreman. An attacker, with permissions to view the debug results, would be able to view the root password associated with that system, potentially allowing them to access it.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 00:53:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1349138, 1359469, 1470445
Bug Blocks:	1349141, 1432305

Description Kurt Seifried 2016-06-22 19:06:02 UTC

Thom Carlin of the Red Hat QCI QE Team reports:

Inside discovery-debug, the root password is displayed in plaintext. A
redacted sample:

"Discovered by URL: https://<<sat6_fqdn>>
Entering screen_ssh
TUI executing: echo 'root:<<plaintext_password>>' | chpasswd &&
systemctl restart sshd.service
Starting Stop Read-Ahead Data Collection...
Started Stop Read-Ahead Data Collection."

The output is also available on the console after discovery if you click
on Logs and scroll down

Comment 1 Kurt Seifried 2016-06-22 19:06:15 UTC

Acknowledgments:

Name: Thom Carlin (Red Hat)

Comment 3 Lukas Zapletal 2016-06-23 11:12:31 UTC

Thanks for report, by default root account is locked on discovered nodes, user needs to enable ssh service manually and enter root password in the dialog. Then it makes into the system journal in clear text.

Comment 7 Lukas Zapletal 2016-06-24 11:41:44 UTC

Updating the dependant 6.1 bug to 6.2 release.

Comment 11 errata-xmlrpc 2018-02-21 12:27:46 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.3 for RHEL 7

Via RHSA-2018:0336 https://access.redhat.com/errata/RHSA-2018:0336