The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:0152 advisory.

    The kexec-tools package contains the /sbin/kexec binary and utilities that     together form the user-space component of the kernel's kexec feature. The     /sbin/kexec binary facilitates a new kernel to boot using the kernel's     kexec feature either on a normal or a panic reboot. The kexec fastboot     mechanism allows booting a Linux kernel from the context of an already     running kernel.

    Kdump used the SSH (Secure Shell) StrictHostKeyChecking=no option when     dumping to SSH targets, causing the target kdump server's SSH host key not     to be checked. This could make it easier for a man-in-the-middle attacker     on the local network to impersonate the kdump SSH target server and     possibly gain access to sensitive information in the vmcore dumps.
    (CVE-2011-3588)

    The mkdumprd utility created initrd files with world-readable permissions.
    A local user could possibly use this flaw to gain access to sensitive     information, such as the private SSH key used to authenticate to a remote     server when kdump was configured to dump to an SSH target. (CVE-2011-3589)

    The mkdumprd utility included unneeded sensitive files (such as all files     from the /root/.ssh/ directory and the host's private SSH keys) in the     resulting initrd. This could lead to an information leak when initrd     files were previously created with world-readable permissions. Note: With     this update, only the SSH client configuration, known hosts files, and the     SSH key configured via the newly introduced sshkey option in     /etc/kdump.conf are included in the initrd. The default is the key     generated when running the service kdump propagate command,     /root/.ssh/kdump_id_rsa. (CVE-2011-3590)

    Red Hat would like to thank Kevan Carstensen for reporting these issues.

    This updated kexec-tools package also includes numerous bug fixes and     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 5.8 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All users of kexec-tools are advised to upgrade to this updated package,     which resolves these security issues, fixes these bugs and adds these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : kexec-tools (RHSA-2012:0152)

critical Nessus Plugin ID 58053

Version 1.25