Red Hat Bugzilla – Bug 1088732
CVE-2014-0189 virt-who: plaintext hypervisor passwords in world-readable /etc/sysconfig/virt-who configuration file
Last modified: 2015-07-22 03:21:53 EDT
It was reported that "/etc/sysconfig/virt-who" is world-readable and contains plaintext passwords to connect to various hypervisors. A local attacker could use this flaw to obtain those passwords and gain access to the hypervisors.
Thanks for the report. Bug 1081286 is also complaint about having unencrypted passwords in world-readable files. I'll make the file root readable only, but is it enough? I don't see any solution how virt-who can unencrypt password from configuration file. Virt-who has to operate unattended, so asking for password is not an option. If virt-who has encrypting key somewhere (disk, source code) what will prevent attacker to read it anyway? It would be just security through obscurity. I'm open to suggestions how to fix it.
Acknowledgements: Red Hat would like to thank Sal Castiglione for reporting this issue.
Public already via https://bugzilla.redhat.com/show_bug.cgi?id=1081286
Again, this bug is not about plain text versus encrypted passwords, but about wrong permissions for file with passwords.
This issue was already addressed in the virt-who updates for Red Hat Enterprise Linux 5 (released as part of Red Hat Enterprise Linux 5.11) and Red Hat Enterprise Linux 6 (released as part of Red Hat Enterprise Linux 6.6) by changing permissions of the /etc/sysconfig/virt-who configuration file to 600, i.e. making the file only readable to the administrative user. https://rhn.redhat.com/errata/RHBA-2014-1206.html https://rhn.redhat.com/errata/RHBA-2014-1513.html Similar change is expected to be included in future updates for Red Hat Enterprise Linux 7.
Created virt-who tracking bugs for this issue: Affects: fedora-all [bug 1186034]
virt-who-0.8-11.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:0430 https://rhn.redhat.com/errata/RHSA-2015-0430.html