Bug 872487 (CVE-2012-4574)

Summary:	CVE-2012-4574 pulp /etc/pulp/pulp.conf world readable, contains default admin password
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, jlaska, katello-bugs, mmccune, security-response-team, whayutin
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-25 06:36:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	798435, 872488
Bug Blocks:	836071, 852201

Description Kurt Seifried 2012-11-02 07:54:34 UTC

During an audit of file permissions within CloudForms it was found that the 
/etc/pulp/pulp.conf is world readable. This file can contain the following 
sensitive information:

# default_password: default password for admin
# Highly recommend changing the default_password with "pulp-admin user update"
#
[server]
...
default_login: admin 
default_password: CVkiDB/JKHhHp7+PlkfaqizG
...
oauth_key: katello
oauth_secret: zH9ZXu6JhDwlx9GjshbFaa0Q

This file should not be world readable, it should only be readable by the 
user/group that pulp runs as.

Comment 3 Vincent Danen 2012-11-30 22:50:19 UTC

Acknowledgements:

This issue was discovered by Kurt Seifried of the Red Hat Security Response Team.

Comment 4 errata-xmlrpc 2012-12-04 19:57:45 UTC

This issue has been addressed in following products:

  CloudForms for RHEL 6
  CloudForms Tools for RHEL 5

Via RHSA-2012:1543 https://rhn.redhat.com/errata/RHSA-2012-1543.html