Bug 1221989 – CVE-2015-3201 thermostat: world-readable configuration file containing credentials

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1221989 - (CVE-2015-3201) CVE-2015-3201 thermostat: world-readable configuration file containing credentials

Summary:	CVE-2015-3201 thermostat: world-readable configuration file containing creden...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-3201

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150520,repor...
Keywords:	Security

Depends On:	1222621 1223505
Blocks:	1221990
	Show dependency tree / graph

Reported:	2015-05-15 08:17 EDT by Martin Prpič
Modified:	2015-07-22 03:23 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was discovered that the Thermostat web application stored database authentication credentials in a world-readable configuration file. A local user on a system running the Thermostat web application could use this flaw to access and modify monitored JVM data, or perform actions on connected JVMs.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-06-04 04:13:15 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1052	normal	SHIPPED_LIVE	Moderate: thermostat1 security, bug fix, and enhancement update	2015-06-04 08:08:05 EDT

Groups: None (edit)

Description Martin Prpič 2015-05-15 08:17:54 EDT

It was found that Thermostat, a multi-user and multi-machine system for monitoring, querying and modifying Java Virtual Machines, stored user credentials in a world-readable file. A local user could use this flaw to retrieve the credentials and potentially affect any Java Virtual Machine connected to Thermostat.

Comment 1 Martin Prpič 2015-05-18 08:34:20 EDT

Acknowledgements:

This issue was discovered by the Red Hat Thermostat Team.

Comment 4 Kurt Seifried 2015-05-20 13:04:31 EDT

Created thermostat tracking bugs for this issue:

Affects: fedora-all [bug 1223505]

Comment 5 Tomas Hoger 2015-05-27 10:31:03 EDT

Upstream bug report:
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372

Upstream commit:
http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a

Additional related fix:
http://icedtea.classpath.org/hg/thermostat/rev/4a5706c9f0cb

Comment 6 errata-xmlrpc 2015-06-04 04:09:35 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2015:1052 https://rhn.redhat.com/errata/RHSA-2015-1052.html

Comment 7 Fedora Update System 2015-06-09 11:02:44 EDT

thermostat-1.2.2-7.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-06-10 15:07:39 EDT

thermostat-1.0.6-2.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.