Test Kennung:	1.3.6.1.4.1.25623.1.0.64178
Kategorie:	Red Hat Local Security Checks
Titel:	RedHat Security Advisory RHSA-2008:0002
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory RHSA-2008:0002. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent DMTF standard that defines a common information model, and communication protocol for monitoring and controlling resources. During a security audit, a stack buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges. (CVE-2008-0003) Note that the tog-pegasus packages are not installed by default on Red Hat Enterprise Linux. The Red Hat Security Response Team believes that it would be hard to remotely exploit this issue to execute arbitrary code, due to the default SELinux targeted policy on Red Hat Enterprise Linux 4 and 5, and the SELinux memory protection tests enabled by default on Red Hat Enterprise Linux 5. Users of tog-pegasus should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages the tog-pegasus service should be restarted. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2008-0002.html http://www.redhat.com/security/updates/classification/#critical CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0003 BugTraq ID: 27172 http://www.securityfocus.com/bid/27172 BugTraq ID: 27188 http://www.securityfocus.com/bid/27188 Bugtraq: 20080416 VMSA-2008-0007 Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus (Google Search) http://www.securityfocus.com/archive/1/490917/100/0/threaded https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00424.html https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00480.html HPdes Security Advisory: HPSBMA02331 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01438409 HPdes Security Advisory: SSRT080000 http://lists.vmware.com/pipermail/security-announce/2008/000014.html http://osvdb.org/40082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10282 http://www.redhat.com/support/errata/RHSA-2008-0002.html http://securitytracker.com/id?1019159 http://secunia.com/advisories/28338 http://secunia.com/advisories/28462 http://secunia.com/advisories/29056 http://secunia.com/advisories/29785 http://secunia.com/advisories/29986 http://www.attrition.org/pipermail/vim/2008-January/001879.html http://www.vupen.com/english/advisories/2008/0063 http://www.vupen.com/english/advisories/2008/0638 http://www.vupen.com/english/advisories/2008/1234/references http://www.vupen.com/english/advisories/2008/1391/references XForce ISS Database: openpegasus-pambasic-bo(39527) https://exchange.xforce.ibmcloud.com/vulnerabilities/39527
Copyright	Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.