Bug 1349136 – CVE-2016-4996 foreman: inside discovery-debug, the root password is displayed in plaintext

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1349136 - (CVE-2016-4996) CVE-2016-4996 foreman: inside discovery-debug, the root password is displayed in plaintext

Summary:	CVE-2016-4996 foreman: inside discovery-debug, the root password is displayed...

Status:	NEW

Aliases:	CVE-2016-4996

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160622,repor...
Keywords:	Security

Depends On:	1349138 1359469 1470445
Blocks:	1349141 1432305
	Show dependency tree / graph

Reported:	2016-06-22 15:06 EDT by Kurt Seifried
Modified:	2018-02-21 07:27 EST (History)
CC List:	13 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in discovery-debug in foreman. An attacker, with permissions to view the debug results, would be able to view the root password associated with that system, potentially allowing them to access it.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:0336	normal	SHIPPED_LIVE	Important: Satellite 6.3 security, bug fix, and enhancement update	2018-02-21 17:43:42 EST

Groups: None (edit)

Description Kurt Seifried 2016-06-22 15:06:02 EDT

Thom Carlin of the Red Hat QCI QE Team reports:

Inside discovery-debug, the root password is displayed in plaintext. A
redacted sample:

"Discovered by URL: https://<<sat6_fqdn>>
Entering screen_ssh
TUI executing: echo 'root:<<plaintext_password>>' | chpasswd &&
systemctl restart sshd.service
Starting Stop Read-Ahead Data Collection...
Started Stop Read-Ahead Data Collection."

The output is also available on the console after discovery if you click
on Logs and scroll down

Comment 1 Kurt Seifried 2016-06-22 15:06:15 EDT

Acknowledgments:

Name: Thom Carlin (Red Hat)

Comment 3 Lukas Zapletal 2016-06-23 07:12:31 EDT

Thanks for report, by default root account is locked on discovered nodes, user needs to enable ssh service manually and enter root password in the dialog. Then it makes into the system journal in clear text.

Comment 7 Lukas Zapletal 2016-06-24 07:41:44 EDT

Updating the dependant 6.1 bug to 6.2 release.

Comment 11 errata-xmlrpc 2018-02-21 07:27:46 EST

This issue has been addressed in the following products:

  Red Hat Satellite 6.3 for RHEL 7

Via RHSA-2018:0336 https://access.redhat.com/errata/RHSA-2018:0336

Note You need to log in before you can comment on or make changes to this bug.