Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1250 advisory.

    Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation     IT infrastructure for enterprise computing. MRG offers increased     performance, reliability, interoperability, and faster computing for     enterprise customers.

    MRG Grid provides high-throughput computing and enables enterprises to     achieve higher peak computing capacity as well as improved infrastructure     utilization by leveraging their existing technology to build high     performance grids. MRG Grid provides a job-queueing mechanism, scheduling     policy, and a priority scheme, as well as resource monitoring and resource     management. Users submit their jobs to MRG Grid, where they are placed into     a queue. MRG Grid then chooses when and where to run the jobs based upon a     policy, carefully monitors their progress, and ultimately informs the user     upon completion.

    A flaw was discovered in Cumin where it would log broker authentication     credentials to the Cumin log file. A local user exploiting this flaw could     connect to the broker outside of Cumin's control and perform certain     operations such as scheduling jobs, setting attributes on jobs, as well as     holding, releasing or removing jobs. The user could also use this to,     depending on the defined ACLs of the broker, manipulate message queues and     other privileged operations. (CVE-2011-2925)

    In addition, these updated packages for Red Hat Enterprise Linux 6 provide     numerous bug fixes and enhancements for the Grid component of MRG. Some of     the most important enhancements include:

    * Expanded support of EC2 features, including EBS and VPC.

    * Improved negotiation performance.

    * Reduced shadow memory usage.

    * Integrated configuration and management experience, including real-time     monitoring, diagnostics, and configuration templates.

    Release Notes:

    * When MRG Grid ran on a node with multiple network interfaces, it tried to     estimate the correct interface for its communications with the remaining     MRG Grid nodes. As a consequence, the node could have failed to communicate     with other parts of MRG Grid correctly if the wrong interface had been     chosen. As a workaround to this issue, MRG Grid can be forced to use a     specific network interface by setting the NETWORK_INTERFACE parameter to     the IP address of that interface. To determine which interface was used by     MRG Grid when it fails to communicate with other parts of the grid, include     the D_HOSTNAME variable in the logging configuration of the corresponding     daemon. (BZ#728285)

    * The remote configuration database requires an update to include changes     for MRG Grid version 2.0.1. But the database snapshot provided with MRG     only contains a basic configuration, and thus loading the database snapshot     would replace the existing pool configuration. To solve this issue, the     upgrade-wallaby-db tool which upgrades an existing deployment's database     has to be used. This tool can be downloaded from the following page:
    https://access.redhat.com/kb/docs/DOC-58404

    * With this update, the Elastic Compute Cloud Grid ASCII Helper Protocol     (EC2 GAHP) is preferred over AMAZON GAHP. The condor-ec2-enhanced-hooks     package has been updated to detect the correct GAHP for the EC2 Enhanced     feature based upon what GAHPs are available on the scheduler. To ensure     that jobs are routed to the proper resources, the 'set_gridresource =     amazon; \' setting should be removed from all existing EC2 Enhanced     routes in a MRG Grid's configuration. (BZ#688717)

    Space precludes documenting all of these changes in this advisory. Refer to     the Red Hat Enterprise MRG 2.0 Technical Notes document for information on     these changes:

    https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/2.0/html/Technical_Notes/index.html

    All users of the Grid capabilities of Red Hat Enterprise MRG 2.0 are     advised to upgrade to these updated packages, which resolve the issues and     add the enhancements noted in the Red Hat Enterprise MRG 2.0 Technical     Notes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1249 advisory.

  - cumin: broker username/password appears in the log file (CVE-2011-2925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
76633	RHEL 6 : Red Hat Enterprise MRG Grid 2.0 (RHSA-2011:1250)	Nessus	Red Hat Local Security Checks	Local	high
76632	RHEL 5 : Red Hat Enterprise MRG Grid 2.0 (RHSA-2011:1249)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2011-2925

high

Tenable Plugins

high

high