The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2011-1532 advisory.

    [2.0.0-209.0.1.el6]
    - Make sure '--allow-missing' is effective by adding to MKDUMPRD_ARGS in       kdump.sysconfig, kdump.sysconfig.i386, and kdump.sysconfig.x86_64 [12590865] [11678808]

    [2.0.0-209]
    - Improve debugfs mounting code, from Dave Young.
      Resolve bug 748748.

    [2.0.0-208]
    - Search DUP firmware directory too, from Caspar Zhang.
      Resolve bug 747233.

    [2.0.0-207]
    - Don't run kdump service on s390x, from Caspar Zhang.
      Resolve bug 746207.

    [2.0.0-206]
    - Fix some security flaws, resolve bug 743165.

    [2.0.0-205]
    - Fix a scriptlet failure in fence-agents, resolve bug 739050.

    [2.0.0-204]
    - Add new config 'force_rebuild', resolve bug 598067.

    [2.0.0-203]
    - Warn users to use maxcpus=1 instead of nr_cpus=1 for older       kernels, resolve bug 727892.

    [2.0.0-202]
    - Pass 'noefi acpi_rsdp=X' to the second kernel, resolve bug 681796.

    [2.0.0-201]
    - Include patch 602 for rawbuild, resolve bug 708503.

    [2.0.0-200]
    - Remove the warning for reserved memory on x86, resolve BZ 731394.

    [2.0.0-199]
    - Add debug_mem_level debugging option, from Jan Stancek.
      Resolve Bug 734528.

    [2.0.0-198]
    - Fix the error message on /etc/cluster_iface,       resolve bug 731236. From Ryan O'Hara.

    [2.0.0-197]
    - Add coordination between kdump and cluster fencing for long       kernel panic dumps, resolve bug 585332. From Ryan O'Hara.

    [2.0.0-196]
    - Use nr_cpus=1 instead of maxcpus=1 on x86, resolve Bug 725484.

    [2.0.0-195]
    - Fix segfault on ppc machine with 1TB memory, resolve Bug 709441.

    [2.0.0-194]
    - Specify kernel version for every modprobe, resolve Bug 719105.

    [2.0.0-193]
    - Don't handle raid device specially, resolve Bug 707805.

    [2.0.0-192]
    - Read mdadm.conf correctly, resolve Bug 707805.

    [2.0.0-191]
    - Use makedumpfile as default core_collector for ssh dump.
      Resolve Bug 693025.

    [2.0.0-190]
    - Revert the previous patch, resolve Bug 701339.

    [2.0.0-189]
    - Disable THP in kdump kernel, resolve Bug 701339.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2012-0152 advisory.

    [1.102pre-154.0.3]
    - mkdumprd.orig get packed, remove it.

    [1.102pre-154.0.2]
    - fix mounting root fs on labeled disk (Maxim Uvarov) [orabug: 13709374]

    [1.102pre-154.0.1]     Merge following patches from mkinitrd:
    - mkinitrd-fix-san-boot.patch
    - mkinitrd-fix-shared-lib-library-path.patch
    - mkinitrd-5.1.19.6-libfirmware-subdir-include.patch
    - mkinitrd-fix-setquiet-for-non-verbose.patch
    - add-option-to-forceload-multipath.patch
    - Update kexec-kdump-howto.txt with Oracle references
    - Add mkdumprd load firmware support [orabug 10432768]
    - Updated makedumpfile to el6 version (Herbert van den Bergh) [orabug 10088607]
    - Merged UEK modification,Updated Source1 kdump.init       Added --allow-missing for rebuilding kdump_initrd
    - Updated kexec-kdump-howto.txt with Oracle references

    [1.102pre-154]
    - Add xfs support, resolve bug 668706.

    [1.102pre-153]
    - Avoid recursive directory deletion when unmount failed, from Cai Qian.
      Resolve bug 781907.

    [1.102pre-152]
    - Replace sed with awk in interface-mapping code,       resolve bug 765702.

    [1.102pre-151]
    - Set pipefail to catch errors in a pipe, resolve bug 761336.

    [1.102pre-150]
    - Remove the restriction for Xen HVM guests, resolve bug 743217.

    [1.102pre-149]
    - Honor the resettable flag, resolve bug 761048.

    [1.102pre-148]
    - Revert the patch in -144, resolve bug 755781. From Cai Qian.

    [1.102pre-147]
    - Poll every ifcfg file to get bridge members, resolve bug 760844.

    [1.102pre-146]
    - Don't add default gateway when there is none. Resolve bug 759006.

    [1.102pre-145]
    - Bypass blacklist option for target checking. Resolve bug 690678.

    [1.102pre-144]
    - Change the default core_collector for raw dump to makedumpfile.
      Resolve bug 755781.

    [1.102pre-143]
    - Support static route. Resolve bug 715531.

    [1.102pre-142]
    - Fix some security flaws. Resolve bug 743163.

    [1.102pre-141]
    - Remove two unused patches.

    [1.102pre-140]
    - Fix link_delay regression since -135, resolve bug 753684.

    [1.102pre-139]
    - Improve debugfs mounting code, from Dave Young. Resolve bug 748749.

    [1.102pre-138]
    - Backport blacklist option. Resolve bug 690678.

    [1.102pre-137]
    - Fix link_delay handling code. Resolve bug 682359.

    [1.102pre-136]
    - Add /etc/fstab into initrd, resolve Bug 748319.

    [1.102pre-135]
    - Support dump over vlan tagged bond. Resolve bug 682359.

    [1.102pre-134]
    - Fix two trivial bugs, Bug 709622 and Bug 662530.

    [1.102pre-133]
    - Support software iscsi as dump target, from Vivek Goyal.
      Resolve bug 719384.

    [1.102pre-132]
    - Add the missing part of the previous patch. Resolve bug 696547.

    [1.102pre-131]
    - Get the backup memory region dynamically. Resolve bug 678308.

    [1.102pre-130]
    - Add ext4 module. Resolve bug 667791.

    [1.102pre-129]
    - Updating release to force brew rebuild

    [1.102pre-128]
    - Check fsck.ext4 binary before include it. Resolve bug 667791.

    [1.102pre-127]
    - Add ext4 support, from Dave Maley. Resolve bug 667791.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kexec-tools package contains the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot mechanism allows booting a Linux kernel from the context of an already running kernel.

Kdump used the SSH (Secure Shell) 'StrictHostKeyChecking=no' option when dumping to SSH targets, causing the target kdump server's SSH host key not to be checked. This could make it easier for a man-in-the-middle attacker on the local network to impersonate the kdump SSH target server and possibly gain access to sensitive information in the vmcore dumps. (CVE-2011-3588)

The mkdumprd utility created initrd files with world-readable permissions. A local user could possibly use this flaw to gain access to sensitive information, such as the private SSH key used to authenticate to a remote server when kdump was configured to dump to an SSH target. (CVE-2011-3589)

The mkdumprd utility included unneeded sensitive files (such as all files from the '/root/.ssh/' directory and the host's private SSH keys) in the resulting initrd. This could lead to an information leak when initrd files were previously created with world-readable permissions. Note: With this update, only the SSH client configuration, known hosts files, and the SSH key configured via the newly introduced sshkey option in '/etc/kdump.conf' are included in the initrd. The default is the key generated when running the 'service kdump propagate' command, '/root/.ssh/kdump_id_rsa'. (CVE-2011-3590)

This updated kexec-tools package also includes numerous bug fixes and enhancements.

All users of kexec-tools are advised to upgrade to this updated package, which resolves these security issues, fixes these bugs and adds these enhancements.

Kexec allows for booting a Linux kernel from the context of an already running kernel.

Kdump used the SSH (Secure Shell) 'StrictHostKeyChecking=no' option when dumping to SSH targets, causing the target kdump server's SSH host key not to be checked. This could make it easier for a man-in-the-middle attacker on the local network to impersonate the kdump SSH target server and possibly gain access to sensitive information in the vmcore dumps. (CVE-2011-3588)

mkdumprd created initrd files with world-readable permissions. A local user could possibly use this flaw to gain access to sensitive information, such as the private SSH key used to authenticate to a remote server when kdump was configured to dump to an SSH target.
(CVE-2011-3589)

mkdumprd included unneeded sensitive files (such as all files from the '/root/.ssh/' directory and the host's private SSH keys) in the resulting initrd. This could lead to an information leak when initrd files were previously created with world-readable permissions. Note:
With this update, only the SSH client configuration, known hosts files, and the SSH key configured via the newly introduced sshkey option in '/etc/kdump.conf' are included in the initrd. The default is the key generated when running the 'service kdump propagate' command, '/root/.ssh/kdump_id_rsa'. (CVE-2011-3590)

This update also fixes several bugs and adds various enhancements.

All kexec-tools users should upgrade to this updated package, which contains backported patches to resolve these issues and add these enhancements.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:0152 advisory.

    The kexec-tools package contains the /sbin/kexec binary and utilities that     together form the user-space component of the kernel's kexec feature. The     /sbin/kexec binary facilitates a new kernel to boot using the kernel's     kexec feature either on a normal or a panic reboot. The kexec fastboot     mechanism allows booting a Linux kernel from the context of an already     running kernel.

    Kdump used the SSH (Secure Shell) StrictHostKeyChecking=no option when     dumping to SSH targets, causing the target kdump server's SSH host key not     to be checked. This could make it easier for a man-in-the-middle attacker     on the local network to impersonate the kdump SSH target server and     possibly gain access to sensitive information in the vmcore dumps.
    (CVE-2011-3588)

    The mkdumprd utility created initrd files with world-readable permissions.
    A local user could possibly use this flaw to gain access to sensitive     information, such as the private SSH key used to authenticate to a remote     server when kdump was configured to dump to an SSH target. (CVE-2011-3589)

    The mkdumprd utility included unneeded sensitive files (such as all files     from the /root/.ssh/ directory and the host's private SSH keys) in the     resulting initrd. This could lead to an information leak when initrd     files were previously created with world-readable permissions. Note: With     this update, only the SSH client configuration, known hosts files, and the     SSH key configured via the newly introduced sshkey option in     /etc/kdump.conf are included in the initrd. The default is the key     generated when running the service kdump propagate command,     /root/.ssh/kdump_id_rsa. (CVE-2011-3590)

    Red Hat would like to thank Kevan Carstensen for reporting these issues.

    This updated kexec-tools package also includes numerous bug fixes and     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 5.8 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All users of kexec-tools are advised to upgrade to this updated package,     which resolves these security issues, fixes these bugs and adds these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2011:1532 advisory.

    Kexec allows for booting a Linux kernel from the context of an already     running kernel.

    Kdump used the SSH (Secure Shell) StrictHostKeyChecking=no option when     dumping to SSH targets, causing the target kdump server's SSH host key not     to be checked. This could make it easier for a man-in-the-middle attacker     on the local network to impersonate the kdump SSH target server and     possibly gain access to sensitive information in the vmcore dumps.
    (CVE-2011-3588)

    mkdumprd created initrd files with world-readable permissions. A local user     could possibly use this flaw to gain access to sensitive information, such     as the private SSH key used to authenticate to a remote server when kdump     was configured to dump to an SSH target. (CVE-2011-3589)

    mkdumprd included unneeded sensitive files (such as all files from the     /root/.ssh/ directory and the host's private SSH keys) in the resulting     initrd. This could lead to an information leak when initrd files were     previously created with world-readable permissions. Note: With this update,     only the SSH client configuration, known hosts files, and the SSH key     configured via the newly introduced sshkey option in /etc/kdump.conf are     included in the initrd. The default is the key generated when running the     service kdump propagate command, /root/.ssh/kdump_id_rsa.
    (CVE-2011-3590)

    Red Hat would like to thank Kevan Carstensen for reporting these issues.

    This update also fixes several bugs and adds various enhancements.
    Space precludes documenting all of these changes in this advisory.
    Documentation for these bug fixes and enhancements will be available     shortly from the Technical Notes document, linked to in the References     section.

    All kexec-tools users should upgrade to this updated package, which     contains backported patches to resolve these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181108	Oracle Linux 6 : kexec-tools (ELSA-2011-1532)	Nessus	Oracle Linux Local Security Checks	critical
68470	Oracle Linux 5 : kexec-tools (ELSA-2012-0152)	Nessus	Oracle Linux Local Security Checks	critical
61265	Scientific Linux Security Update : kexec-tools on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	medium
61189	Scientific Linux Security Update : kexec-tools on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58053	RHEL 5 : kexec-tools (RHSA-2012:0152)	Nessus	Red Hat Local Security Checks	critical
57013	RHEL 6 : kexec-tools (RHSA-2011:1532)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-3588

critical

Tenable Plugins

critical

critical

medium

medium

critical

critical