Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, might allow remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2007-5360.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0002 advisory.

    [2.6.1-2.el5_1.1.0.1]
     - Added pegasus-enterprise.patch to allow detection of enterprise-release

     [2.6.1-2.el5_1.1]
     - Fix PAM authentication buffer overflow (CVE-2008-0003)        Resolves: #427213

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

During a security audit, a stack-based buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges.
(CVE-2008-0003)

Users of tog-pegasus should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages the tog-pegasus service should be restarted.

a. Updated pcre Service Console package addresses several security issues

The pcre package contains the Perl-Compatible Regular Expression library.
pcre is used by various Service Console utilities.

Several security issues were discovered in the way PCRE handles regular expressions. If an application linked against PCRE parsed a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.

VMware would like to thank Ludwig Nussel for reporting these issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2006-7228 and CVE-2007-1660 to these issues.

b. Updated net-snmp Service Console package addresses denial of service

net-snmp is an implementation of the Simple Network Management Protocol (SNMP).  SNMP is used by network management systems to monitor hosts.  By default ESX has this service enabled and its ports open on the ESX firewall.

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port could send a malicious packet causing snmpd to crash, resulting in a denial of service.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5846 to this issue.

c. Updated OpenPegasus Service Console package fixes overflow condition

OpenPegasus is a CIM (Common Information Model) and Web-Based Enterprise Management (WBEM) broker.  These protocols are used by network management systems to monitor and control hosts.  By default ESX has this service enabled and its ports open on the ESX firewall.

A flaw was discovered in the OpenPegasus CIM management server that might allow remote attackers to execute arbitrary code.  OpenPegasus when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, has a stack-based buffer overflow condition.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-0003 to this issue.

s700_800 11.23 HP WBEM Services A.02.00.11 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.11 HP WBEM Services A.02.00.11 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.31 HP WBEM Services A.02.07 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.31 HP WBEM Services A.02.05.08 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.23 HP WBEM Services A.02.05.08 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.11 HP WBEM Services A.02.05.08 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.23 HP WBEM Services A.02.07 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

s700_800 11.11 HP WBEM Services A.02.07.01 : 

Potential security vulnerabilities have been identified with HP-UX running WBEM Services. These vulnerabilities could be exploited remotely to execute arbitrary code or to gain extended privileges.

- Thu Jan 10 2008 Vitezslav Crhonek <vcrhonek at     redhat.com> - 2.6.1-3

    - Fix PAM authentication buffer overflow (CVE-2008-0003)       Resolves: #427829

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Jan 10 2008 Vitezslav Crhonek <vcrhonek at     redhat.com> - 2.6.0-3

    - Fix PAM authentication buffer overflow (CVE-2008-0003)       Resolves: #427828

  - Wed Mar 28 2007 Vitezslav Crhonek <vcrhonek at     redhat.com> - 2.6.0-2

    - Update changelog

    - Build with Open Pegasus' Makefiles, istall with       RedHats (Mark Hamzy)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated tog-pegasus packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent DMTF standard that defines a common information model, and communication protocol for monitoring and controlling resources.

During a security audit, a stack-based buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges.
(CVE-2008-0003)

Note that the tog-pegasus packages are not installed by default on Red Hat Enterprise Linux. The Red Hat Security Response Team believes that it would be hard to remotely exploit this issue to execute arbitrary code, due to the default SELinux targeted policy on Red Hat Enterprise Linux 4 and 5, and the SELinux memory protection tests enabled by default on Red Hat Enterprise Linux 5.

Users of tog-pegasus should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages the tog-pegasus service should be restarted.

ID	Name	Product	Family	Severity
67629	Oracle Linux 5 : Critical: / tog-pegasus (ELSA-2008-0002)	Nessus	Oracle Linux Local Security Checks	critical
60341	Scientific Linux Security Update : tog-pegasus on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
40377	VMSA-2008-0007 : Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus	Nessus	VMware ESX Local Security Checks	critical
35698	HP-UX PHSS_38748 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
35697	HP-UX PHSS_38747 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32159	HP-UX PHSS_37891 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32158	HP-UX PHSS_37704 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32157	HP-UX PHSS_37703 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32156	HP-UX PHSS_37702 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32155	HP-UX PHSS_37701 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
32154	HP-UX PHSS_37700 : HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileges (HPSBMA02331 SSRT080000 rev.3)	Nessus	HP-UX Local Security Checks	critical
29949	Fedora 8 : tog-pegasus-2.6.1-3.fc8 (2008-0572)	Nessus	Fedora Local Security Checks	critical
29946	Fedora 7 : tog-pegasus-2.6.0-3.fc7 (2008-0506)	Nessus	Fedora Local Security Checks	critical
29931	CentOS 4 / 5 : tog-pegasus (CESA-2008:0002)	Nessus	CentOS Local Security Checks	critical
29875	RHEL 4 / 5 : tog-pegasus (RHSA-2008:0002)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2008-0003

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical