Bug 472524 - (CVE-2008-5188) CVE-2008-5188 ecryptfs-utils: potential provided password disclosure in the process table
CVE-2008-5188 ecryptfs-utils: potential provided password disclosure in the p...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
source=osssecurity,reported=20081023,...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-11-21 09:33 EST by Jan Lieskovsky
Modified: 2009-09-02 08:10 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-02 06:28:19 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2008-11-21 09:33:39 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5188 to
the following vulnerability:

The (1) ecryptfs-setup-private, (2) ecryptfs-setup-confidential, and
(3) ecryptfs-setup-pam-wrapped.sh scripts in ecryptfs-utils 45 through
61 in eCryptfs place cleartext passwords on command lines, which
allows local users to obtain sensitive information by listing the
process.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5188
http://www.openwall.com/lists/oss-security/2008/10/23/3
http://www.openwall.com/lists/oss-security/2008/10/29/4
http://www.openwall.com/lists/oss-security/2008/10/29/7
http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git;a=commit;h=06de99afd53f03fe07eda0ad9d61ac6d5d4d9f53
https://launchpad.net/bugs/287908

Note: The ecryptfs-utils as shipped with Red Hat Enterprise Linux does not
contain the 'ecryptfs-setup-private' script mentioned in the above CVE entry
(present in ecryptfs-utils starting from versions -45+), but it contains 'ecryptfs-add-passphrase.c' and 'ecryptfs-wrap-passphrase.c'
files affected by this vulnerability.
Comment 1 Jan Lieskovsky 2008-11-21 09:39:48 EST
This issue affects the version of the ecryptfs-utils package as shipped
with Red Hat Enterprise Linux 5.

This issue affects the versions of the ecryptfs-utils package as shipped
with Fedora releases of 9 and 10.
Comment 2 Jan Lieskovsky 2008-11-21 09:40:48 EST
The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw.  More information regarding
issue severity can be found here:
http://www.redhat.com/security/updates/classification/
Comment 3 errata-xmlrpc 2009-09-02 05:56:27 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1307 https://rhn.redhat.com/errata/RHSA-2009-1307.html
Comment 4 Tomas Hoger 2009-09-02 06:28:19 EDT
All current Fedora versions are already updated to fixed upstream versions too.
Comment 5 errata-xmlrpc 2009-09-02 08:10:49 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1307 https://rhn.redhat.com/errata/RHSA-2009-1307.html

Note You need to log in before you can comment on or make changes to this bug.