Bug 1340525 (CVE-2016-4455) - CVE-2016-4455 subscription-manager: sensitive world readable files in /var/lib/rhsm/
Summary: CVE-2016-4455 subscription-manager: sensitive world readable files in /var/li...
Status: CLOSED ERRATA
Alias: CVE-2016-4455
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20160525,repor...
Keywords: Security
Depends On: 1297485 1297493 1389449
Blocks: 1297763 1386080
TreeView+ depends on / blocked
 
Reported: 2016-05-27 17:21 UTC by Cedric Buissart 🐶
Modified: 2019-06-08 21:13 UTC (History)
6 users (show)

(edit)
It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack.
Clone Of:
(edit)
Last Closed: 2017-03-21 11:42:47 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2592 normal SHIPPED_LIVE Moderate: subscription-manager security, bug fix, and enhancement update 2016-11-03 12:10:42 UTC
Red Hat Product Errata RHSA-2017:0698 normal SHIPPED_LIVE Moderate: subscription-manager security, bug fix, and enhancement update 2017-03-21 12:39:12 UTC

Description Cedric Buissart 🐶 2016-05-27 17:21:06 UTC
/var/lib/rhsm/cache/entitlement_status.json and /var/lib/rhsm/facts/facts.json are world readable but contain sensitive information (Red Hat Contract number and hardware serial number, sufficient to authenticate again Red Hat and hardware vendor support) can could be used by an attacker to perform a social engineering attack.

Upstream patch:

https://github.com/candlepin/subscription-manager/commit/9dec31

Comment 1 Cedric Buissart 🐶 2016-05-27 17:21:16 UTC
Acknowledgments:

Name: Robert Scheck

Comment 4 errata-xmlrpc 2016-11-03 20:29:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2592 https://rhn.redhat.com/errata/RHSA-2016-2592.html

Comment 11 errata-xmlrpc 2017-03-21 10:55:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0698 https://rhn.redhat.com/errata/RHSA-2017-0698.html


Note You need to log in before you can comment on or make changes to this bug.