Bug 731574 (CVE-2011-2925) - CVE-2011-2925 cumin: broker username/password appears in the log file
Summary: CVE-2011-2925 cumin: broker username/password appears in the log file
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-2925
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20110907,reported=20110810,sou...
Depends On: 728960
Blocks: 731578
TreeView+ depends on / blocked
 
Reported: 2011-08-17 21:11 UTC by Vincent Danen
Modified: 2019-06-08 18:53 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-09-09 17:19:33 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1249 normal SHIPPED_LIVE Moderate: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update 2011-09-07 16:40:45 UTC
Red Hat Product Errata RHSA-2011:1250 normal SHIPPED_LIVE Moderate: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update 2011-09-07 16:40:29 UTC

Description Vincent Danen 2011-08-17 21:11:41 UTC
A flaw was discovered in cumin where it would log broker authentication credentials to the cumin log file.  A local user exploiting this flaw could connect to the broker outside of cumin's control and perform certain operations such as scheduling jobs, setting attributes on jobs, as well as holding, releasing or removing jobs.  The user could also use this to, depending on the defined ACLs of the broker, manipulate message queues and other privileged operations.

Comment 2 Vincent Danen 2011-08-18 20:43:21 UTC
Note that in MRG 2, the broker username and password are stored in configuration files that are not  publicly readable (unlike MRG 1.3).  As well, in MRG 1.3, cumin operations were not restricted by any authentication, unlike MRG 2 where authentication is required.  This makes the exposure of credentials in the MRG 2 log files much more significant than on MRG 1.3.

Comment 4 errata-xmlrpc 2011-09-07 16:40:35 UTC
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1250 https://rhn.redhat.com/errata/RHSA-2011-1250.html

Comment 5 errata-xmlrpc 2011-09-07 16:40:51 UTC
This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2011:1249 https://rhn.redhat.com/errata/RHSA-2011-1249.html


Note You need to log in before you can comment on or make changes to this bug.