Bug 1088732 (CVE-2014-0189) - CVE-2014-0189 virt-who: plaintext hypervisor passwords in world-readable /etc/sysconfig/virt-who configuration file
Summary: CVE-2014-0189 virt-who: plaintext hypervisor passwords in world-readable /etc...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0189
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1088756 1158759 1186034
Blocks: 1088733 1121513
TreeView+ depends on / blocked
 
Reported: 2014-04-17 04:43 UTC by Murray McAllister
Modified: 2021-02-17 06:38 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that the /etc/sysconfig/virt-who configuration file, which may contain hypervisor authentication credentials, was world-readable. A local user could use this flaw to obtain authentication credentials from this file.
Clone Of:
Environment:
Last Closed: 2015-03-06 10:25:54 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0430 0 normal SHIPPED_LIVE Moderate: virt-who security, bug fix, and enhancement update 2015-03-05 14:52:46 UTC

Description Murray McAllister 2014-04-17 04:43:08 UTC
It was reported that "/etc/sysconfig/virt-who" is world-readable and contains plaintext passwords to connect to various hypervisors. A local attacker could use this flaw to obtain those passwords and gain access to the hypervisors.

Comment 4 Radek Novacek 2014-04-17 06:27:19 UTC
Thanks for the report. Bug 1081286 is also complaint about having unencrypted passwords in world-readable files.

I'll make the file root readable only, but is it enough? I don't see any solution how virt-who can unencrypt password from configuration file.

Virt-who has to operate unattended, so asking for password is not an option. If virt-who has encrypting key somewhere (disk, source code) what will prevent attacker to read it anyway? It would be just security through obscurity.

I'm open to suggestions how to fix it.

Comment 5 Murray McAllister 2014-04-24 05:37:16 UTC
Acknowledgements:

Red Hat would like to thank Sal Castiglione for reporting this issue.

Comment 8 Murray McAllister 2014-04-28 02:11:58 UTC
Public already via https://bugzilla.redhat.com/show_bug.cgi?id=1081286

Comment 16 Radek Novacek 2015-01-26 12:28:49 UTC
Again, this bug is not about plain text versus encrypted passwords, but about wrong permissions for file with passwords.

Comment 18 Tomas Hoger 2015-01-26 20:41:59 UTC
This issue was already addressed in the virt-who updates for Red Hat Enterprise Linux 5 (released as part of Red Hat Enterprise Linux 5.11) and Red Hat Enterprise Linux 6 (released as part of Red Hat Enterprise Linux 6.6) by changing permissions of the /etc/sysconfig/virt-who configuration file to 600, i.e. making the file only readable to the administrative user.

https://rhn.redhat.com/errata/RHBA-2014-1206.html
https://rhn.redhat.com/errata/RHBA-2014-1513.html

Similar change is expected to be included in future updates for Red Hat Enterprise Linux 7.

Comment 19 Tomas Hoger 2015-01-26 21:22:33 UTC
Created virt-who tracking bugs for this issue:

Affects: fedora-all [bug 1186034]

Comment 20 Fedora Update System 2015-02-15 03:23:57 UTC
virt-who-0.8-11.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 21 errata-xmlrpc 2015-03-05 10:23:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0430 https://rhn.redhat.com/errata/RHSA-2015-0430.html


Note You need to log in before you can comment on or make changes to this bug.