RHEL 2.1 / 3 / 4 : sysreport (RHSA-2005:502)

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated sysreport package that fixes an information disclosure flaw
is now available.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team

Sysreport is a utility that gathers information about a system's
hardware and configuration. The information can then be used for
diagnostic purposes and debugging.

When run by the root user, sysreport includes the contents of the
/etc/sysconfig/rhn/up2date configuration file. If up2date has been
configured to connect to a proxy server that requires an
authentication password, that password is included in plain text in
the system report. The Common Vulnerabilities and Exposures project
assigned the name CVE-2005-1760 to this issue.

Users of sysreport should update to this erratum package, which
contains a patch that removes any proxy authentication passwords.

See also :

https://www.redhat.com/security/data/cve/CVE-2005-1760.html
http://rhn.redhat.com/errata/RHSA-2005-502.html

Solution :

Update the affected sysreport package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 18474 ()

Bugtraq ID:

CVE ID: CVE-2005-1760