The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1536 advisory.

    [2.2-17.0.1.el6]
    - Direct traceroute to linux.oracle.com (John Haxby) [orabug 11713272]
    - Allow '-' in ticket (SR) numbers (John Haxby)
    - Disable --upload option as it will not work with Oracle support
    - Check oraclelinux-release instead of redhat-release to get OS version (John Haxby) [bug 11681869]
    - Remove RH ftp URL and support email
    - add sos-oracle-enterprise.patch

    [2.2-17]
    - Do not collect subscription manager keys in general plugin     Resolves: bz750607

    [2.2-16]
    - Fix execution of RHN hardware.py from hardware plugin     Resolves: bz736718
    - Fix hardware plugin to support new lsusb path     Resolves: bz691477

    [2.2-15]
    - Fix brctl collection when a bridge contains no interfaces       Resolves: bz697899
    - Fix up2dateclient path in hardware plugin       Resolves: bz736718

    [2.2-14]
    - Collect brctl show and showstp output       Resolves: bz697899
    - Collect nslcd.conf in ldap plugin       Resolves: bz682124

    [2.2-11]
    - Truncate files that exceed specified size limit       Resolves: bz683219
    - Add support for collecting Red Hat Subscrition Manager configuration       Resolves: bz714293
    - Collect /etc/init on systems using upstart       Resolves: bz694813
    - Don't strip whitespace from output of external programs       Resolves: bz713449
    - Collect ipv6 neighbour table in network module       Resolves: bz721163
    - Collect basic cgroups configuration data       Resolves: bz729455

    [2.2-10]
    - Fix collection of data from LVM2 reporting tools in devicemapper plugin       Resolves: bz704383
    - Add /proc/vmmemctl collection to vmware plugin       Resolves: bz709491

    [2.2-9]
    - Collect yum repository list by default       Resolves: bz600813
    - Add basic Infiniband plugin       Resolves: bz673244
    - Add plugin for scsi-target-utils iSCSI target       Resolves: bz677124
    - Fix autofs plugin LC_ALL usage       Resolves: bz683404
    - Fix collection of lsusb and add collection of -t and -v outputs       Resolves: bz691477
    - Extend data collection by qpidd plugin       Resolves: bz726360
    - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin       Resolves: bz726427

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2012:0153 :

An updated sos package that fixes one security issue, several bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Sos is a set of tools that gather information about system hardware and configuration.

The sosreport utility incorrectly included Certificate-based Red Hat Network private entitlement keys in the resulting archive of debugging information. An attacker able to access the archive could use the keys to access Red Hat Network content available to the host. This issue did not affect users of Red Hat Network Classic. (CVE-2011-4083)

This updated sos package also includes numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 5.8 Technical Notes, linked to in the References, for information on the most significant of these changes.

All sos users are advised to upgrade to this updated package, which resolves these issues and adds these enhancements.

An updated sos package that fixes one security issue, several bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Sos is a set of tools that gather information about system hardware and configuration.

The sosreport utility incorrectly included Certificate-based Red Hat Network private entitlement keys in the resulting archive of debugging information. An attacker able to access the archive could use the keys to access Red Hat Network content available to the host. This issue did not affect users of Red Hat Network Classic. (CVE-2011-4083)

This updated sos package also includes numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 5.8 Technical Notes, linked to in the References, for information on the most significant of these changes.

All sos users are advised to upgrade to this updated package, which resolves these issues and adds these enhancements.

Sos is a set of tools that gather information about system hardware and configuration.

The sosreport utility incorrectly included Certificate-based private entitlement keys for upstream updates in the resulting archive of debugging information. An attacker able to access the archive could use the keys to access content available to the host. Scientific Linux systems cannot use this upstream service and are unaffected.
(CVE-2011-4083)

This updated sos package also includes numerous bug fixes and enhancements.

All sos users are advised to upgrade to this updated package, which resolves these issues and adds these enhancements.

Sos is a set of tools that gather information about system hardware and configuration.

The sosreport utility incorrectly included aspects of TUV's Certificate-based private entitlement keys in the resulting archive of debugging information. An attacker able to access the archive could use the keys to access that content available to the host. This issue did not affect users of the 'Classic' access method. (CVE-2011-4083)

This updated sos package also includes numerous bug fixes and enhancements.

All users of sos are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1536 advisory.

    Sos is a set of tools that gather information about system hardware and     configuration.

    The sosreport utility incorrectly included Certificate-based Red Hat     Network private entitlement keys in the resulting archive of debugging     information. An attacker able to access the archive could use the keys to     access Red Hat Network content available to the host. This issue did not     affect users of Red Hat Network Classic. (CVE-2011-4083)

    This updated sos package also includes numerous bug fixes and enhancements.
    Space precludes documenting all of these changes in this advisory.
    Documentation for these bug fixes and enhancements will be available     shortly from the Technical Notes document, linked to in the References     section.

    All users of sos are advised to upgrade to this updated package, which     contains backported patches to correct these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181091	Oracle Linux 6 : sos (ELSA-2011-1536)	Nessus	Oracle Linux Local Security Checks	high
68471	Oracle Linux 5 : sos (ELSA-2012-0153)	Nessus	Oracle Linux Local Security Checks	medium
63564	CentOS 5 : sos (CESA-2012:0153)	Nessus	CentOS Local Security Checks	medium
61270	Scientific Linux Security Update : sos on SL5.x (20120221)	Nessus	Scientific Linux Local Security Checks	medium
61198	Scientific Linux Security Update : sos on SL6.x	Nessus	Scientific Linux Local Security Checks	medium
58054	RHEL 5 : sos (RHSA-2012:0153)	Nessus	Red Hat Local Security Checks	medium
57016	RHEL 6 : sos (RHSA-2011:1536)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-4083

high

Tenable Plugins

high

medium

medium

medium

medium

medium

high