Bug 1340525 (CVE-2016-4455) - CVE-2016-4455 subscription-manager: sensitive world readable files in /var/lib/rhsm/
Summary: CVE-2016-4455 subscription-manager: sensitive world readable files in /var/li...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-4455
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1297485 1297493 1389449
Blocks: 1297763 1386080
TreeView+ depends on / blocked
 
Reported: 2016-05-27 17:21 UTC by Cedric Buissart
Modified: 2021-02-17 03:48 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack.
Clone Of:
Environment:
Last Closed: 2017-03-21 11:42:47 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2592 0 normal SHIPPED_LIVE Moderate: subscription-manager security, bug fix, and enhancement update 2016-11-03 12:10:42 UTC
Red Hat Product Errata RHSA-2017:0698 0 normal SHIPPED_LIVE Moderate: subscription-manager security, bug fix, and enhancement update 2017-03-21 12:39:12 UTC

Description Cedric Buissart 2016-05-27 17:21:06 UTC 
/var/lib/rhsm/cache/entitlement_status.json and /var/lib/rhsm/facts/facts.json are world readable but contain sensitive information (Red Hat Contract number and hardware serial number, sufficient to authenticate again Red Hat and hardware vendor support) can could be used by an attacker to perform a social engineering attack.

Upstream patch:

https://github.com/candlepin/subscription-manager/commit/9dec31
Comment 1 Cedric Buissart 2016-05-27 17:21:16 UTC 
Acknowledgments:

Name: Robert Scheck
Comment 4 errata-xmlrpc 2016-11-03 20:29:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2592 https://rhn.redhat.com/errata/RHSA-2016-2592.html
Comment 11 errata-xmlrpc 2017-03-21 10:55:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0698 https://rhn.redhat.com/errata/RHSA-2017-0698.html
Note You need to log in before you can comment on or make changes to this bug.