It was found that Thermostat, a multi-user and multi-machine system for monitoring, querying and modifying Java Virtual Machines, stored user credentials in a world-readable file. A local user could use this flaw to retrieve the credentials and potentially affect any Java Virtual Machine connected to Thermostat.
Acknowledgements: This issue was discovered by the Red Hat Thermostat Team.
Created thermostat tracking bugs for this issue: Affects: fedora-all [bug 1223505]
Upstream bug report: http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372 Upstream commit: http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a Additional related fix: http://icedtea.classpath.org/hg/thermostat/rev/4a5706c9f0cb
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2015:1052 https://rhn.redhat.com/errata/RHSA-2015-1052.html
thermostat-1.2.2-7.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
thermostat-1.0.6-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.