A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-1001 advisory.

    [2.7.0-2.0.1.el5_2.1]
    - Added pegasus-enterprise.patch to allow detection of enterprise-release

    [2.7.0-2.el5_2.1]
    - Fix local-or-remote-auth patch and enhance PAM security settings       Resolves: #471370

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Scientific Linux defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release.

After re-basing to version 2.7.0 of the OpenGroup Pegasus code, these additional security enhancements were no longer being applied. As a consequence, access to OpenPegasus WBEM services was not restricted to the dedicated users. An attacker able to authenticate using a valid user account could use this flaw to send requests to WBEM services.
(CVE-2008-4313)

Note: default SELinux policy prevents tog-pegasus from modifying system files. This flaw's impact depends on whether or not tog-pegasus is confined by SELinux, and on any additional CMPI providers installed and enabled on a particular system.

Failed authentication attempts against the OpenPegasus CIM server were not logged to the system log. An attacker could use this flaw to perform password guessing attacks against a user account without leaving traces in the system log. (CVE-2008-4315)

Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources.

Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file 'README.RedHat.Security', included in the Red Hat tog-pegasus package.

After re-basing to version 2.7.0 of the OpenGroup Pegasus code, these additional security enhancements were no longer being applied. As a consequence, access to OpenPegasus WBEM services was not restricted to the dedicated users as described in README.RedHat.Security. An attacker able to authenticate using a valid user account could use this flaw to send requests to WBEM services. (CVE-2008-4313)

Note: default SELinux policy prevents tog-pegasus from modifying system files. This flaw's impact depends on whether or not tog-pegasus is confined by SELinux, and on any additional CMPI providers installed and enabled on a particular system.

Failed authentication attempts against the OpenPegasus CIM server were not logged to the system log as documented in README.RedHat.Security.
An attacker could use this flaw to perform password guessing attacks against a user account without leaving traces in the system log.
(CVE-2008-4315)

All tog-pegasus users are advised to upgrade to these updated packages, which contain patches to correct these issues.

ID	Name	Product	Family	Severity
67770	Oracle Linux 5 : tog-pegasus (ELSA-2008-1001)	Nessus	Oracle Linux Local Security Checks	critical
60499	Scientific Linux Security Update : tog-pegasus on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43717	CentOS 5 : tog-pegasus (CESA-2008:1001)	Nessus	CentOS Local Security Checks	medium
34956	RHEL 5 : tog-pegasus (RHSA-2008:1001)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2008-4313

medium

Tenable Plugins

critical

medium

medium

medium