RedHat Linux SysReport Proxy Information Disclosure Vulnerability
BID:13936
Info
RedHat Linux SysReport Proxy Information Disclosure Vulnerability
| Bugtraq ID: | 13936 |
| Class: | Design Error |
| CVE: |
CVE-2005-1760 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 13 2005 12:00AM |
| Updated: | Aug 05 2010 07:45PM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
SGI ProPack 3.0 SGI Advanced Linux Environment 3.0 Redhat sysreport 1.3 Redhat sysreport 1.2 Redhat sysreport 1.1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Desktop 4.0 Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 |
| Not Vulnerable: |
Redhat sysreport 1.3.15 -2 Redhat sysreport 1.3.7 .2-6 Redhat sysreport 1.3.7 .0-4 |
Discussion
RedHat Linux SysReport Proxy Information Disclosure Vulnerability
Sysreport is susceptible to an information disclosure vulnerability. This issue is due to a failure of the application to ensure that sensitive information is not included in its generated reports.
This vulnerability may result in sending unencrypted proxy authentication usernames and passwords to potentially malicious people. This may aid them in further attacks.
Sysreport is susceptible to an information disclosure vulnerability. This issue is due to a failure of the application to ensure that sensitive information is not included in its generated reports.
This vulnerability may result in sending unencrypted proxy authentication usernames and passwords to potentially malicious people. This may aid them in further attacks.
Exploit / POC
RedHat Linux SysReport Proxy Information Disclosure Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
RedHat Linux SysReport Proxy Information Disclosure Vulnerability
Solution:
RedHat has released advisory RHSA-2005:502-03, along with fixes to address this issue for RedHat Enterprise Linux, and Desktop Linux. Please see the referenced advisory for further information on obtaining fixes.
Users of the affected utility that are not running operating systems covered in the RedHat advisory should contact RedHat for further information on obtaining fixes.
SGI has released advisory 20050603-01-U to address this, and other issues for SGI Advanced Linux Environment 3, and SGI ProPack 3 Service Pack 5. Please see the referenced advisory for further information.
RedHat has released advisory RHSA-2005:598-04, along with fixes to address this issue. Please see the referenced advisory for further information.
Solution:
RedHat has released advisory RHSA-2005:502-03, along with fixes to address this issue for RedHat Enterprise Linux, and Desktop Linux. Please see the referenced advisory for further information on obtaining fixes.
Users of the affected utility that are not running operating systems covered in the RedHat advisory should contact RedHat for further information on obtaining fixes.
SGI has released advisory 20050603-01-U to address this, and other issues for SGI Advanced Linux Environment 3, and SGI ProPack 3 Service Pack 5. Please see the referenced advisory for further information.
RedHat has released advisory RHSA-2005:598-04, along with fixes to address this issue. Please see the referenced advisory for further information.
References
RedHat Linux SysReport Proxy Information Disclosure Vulnerability
References:
References: