The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information, which might allow attackers to obtain passwords or password hashes.

The sosreport utility collected the Kickstart configuration file ('/root /anaconda-ks.cfg'), but did not remove the root user's password from it before adding the file to the resulting archive of debugging information. An attacker able to access the archive could possibly use this flaw to obtain the root user's password.
'/root/anaconda-ks.cfg' usually only contains a hash of the password, not the plain text password. (CVE-2012-2664)

Note: This issue affected all installations, not only systems installed via Kickstart. A '/root/anaconda-ks.cfg' file is created by all installation types.

The utility also collects yum repository information from '/etc/yum.repos.d' which in uncommon configurations may contain passwords. Any http_proxy password specified in these files will now be automatically removed. Passwords embedded within URLs in these files should be manually removed or the files excluded from the archive.

An updated sos package that fixes one security issue is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging.

The sosreport utility collected the Kickstart configuration file ('/root/anaconda-ks.cfg'), but did not remove the root user's password from it before adding the file to the resulting archive of debugging information. An attacker able to access the archive could possibly use this flaw to obtain the root user's password. '/root/anaconda-ks.cfg' usually only contains a hash of the password, not the plain text password. (CVE-2012-2664)

Note: This issue affected all installations, not only systems installed via Kickstart. A '/root/anaconda-ks.cfg' file is created by all installation types.

The utility also collects yum repository information from '/etc/yum.repos.d' which in uncommon configurations may contain passwords. Any http_proxy password specified in these files will now be automatically removed. Passwords embedded within URLs in these files should be manually removed or the files excluded from the archive.

All users of sos are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-1121 advisory.

    [1.7-9.62.0.1.el5_9.1]
    - add patch to remove all sysrq echo commands from sysreport.legacy       (John Sobecki) [orabug 11061754]
    - comment out rh-upload-core and README.rh-upload-core in specfile

    [1.7-9.62.el5_9.1]
    - Remove anaconda-ks.cfg collection from general plug-in       Resolves: bz965807

    [1.7-9.62.el5_9]
    - Elide passwords in anaconda-ks.cfg and yum.repos.d       Resolves: bz965807

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0958 advisory.

    [2.2-29.0.1.el6]
    - Direct traceroute to linux.oracle.com (John Haxby) [orabug 11713272]
    - Disable --upload option as it will not work with Oracle support
    - Check oraclelinux-release instead of redhat-release to get OS version (John Haxby) [bug 11681869]
    - Remove RH ftp URL and support email
    - add sos-oracle-enterprise.patch

    [2.2-29.el6]
    - Collect the swift configuration directory in gluster module       Resolves: bz822442
    - Update IPA module and related plug-ins       Resolves: bz812395

    [2.2-28.el6]
    - Collect mcelog files in the hardware module       Resolves: bz810702

    [2.2-27.el6]
    - Add nfs statedump collection to gluster module       Resolves: bz752549

    [2.2-26.el6]
    - Use wildcard to match possible libvirt log paths       Resolves: bz814474

    [2.2-25.el6]
    - Add forbidden paths for new location of gluster private keys       Resolves: bz752549

    [2.2-24.el6]
    - Fix katello and aeolus command string syntax       Resolves: bz752666
    - Remove stray hunk from gluster module patch       Resolves: bz784061

    [2.2-22.el6]
    - Correct aeolus debug invocation in CloudForms module       Resolves: bz752666
    - Update gluster module for gluster-3.3       Resolves: bz784061
    - Add additional command output to gluster module       Resolves: bz768641
    - Add support for collecting gluster configuration and logs       Resolves: bz752549

    [2.2-19.el6]
    - Collect additional diagnostic information for realtime systems       Resolves: bz789096
    - Improve sanitization of RHN user and case number in report name       Resolves: bz771393
    - Fix verbose output and debug logging       Resolves: bz782339
    - Add basic support for CloudForms data collection       Resolves: bz752666
    - Add support for Subscription Asset Manager diagnostics       Resolves: bz752670

    [2.2-18.el6]
    - Collect fence_virt.conf in cluster module       Resolves: bz760995
    - Fix collection of /proc/net directory tree       Resolves: bz730641
    - Gather output of cpufreq-info when present       Resolves: bz760424
    - Fix brctl showstp output when bridges contain multiple interfaces       Resolves: bz751273
    - Add /etc/modprobe.d to kernel module       Resolves: bz749919
    - Ensure relative symlink targets are correctly handled when copying       Resolves: bz782589
    - Fix satellite and proxy package detection in rhn plugin       Resolves: bz749262
    - Collect stderr output from external commands       Resolves: bz739080
    - Collect /proc/cgroups in the cgroups module       Resolve: bz784874
    - Collect /proc/irq in the kernel module       Resolves: bz784862
    - Fix installed-rpms formatting for long package names       Resolves: bz767827
    - Add symbolic links for truncated log files       Resolves: bz766583
    - Collect non-standard syslog and rsyslog log files       Resolves: bz771501
    - Use correct paths for tomcat6 in RHN module       Resolves: bz749279
    - Obscure root password if present in anacond-ks.cfg       Resolves: bz790402
    - Do not accept embedded forward slashes in RHN usernames       Resolves: bz771393
    - Add new sunrpc module to collect rpcinfo for gluster systems       Resolves: bz784061

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging.

The sosreport utility collected the Kickstart configuration file ('/root/anaconda-ks.cfg'), but did not remove the root user's password from it before adding the file to the resulting archive of debugging information. An attacker able to access the archive could possibly use this flaw to obtain the root user's password. '/root/anaconda-ks.cfg' usually only contains a hash of the password, not the plain text password. (CVE-2012-2664)

Note: This issue affected all installations, not only systems installed via Kickstart. A '/root/anaconda-ks.cfg' file is created by all installation types.

This updated sos package also includes numerous bug fixes and enhancements.

All users of sos are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

An updated sos package that fixes one security issue, several bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging.

The sosreport utility collected the Kickstart configuration file ('/root/anaconda-ks.cfg'), but did not remove the root user's password from it before adding the file to the resulting archive of debugging information. An attacker able to access the archive could possibly use this flaw to obtain the root user's password. '/root/anaconda-ks.cfg' usually only contains a hash of the password, not the plain text password. (CVE-2012-2664)

Note: This issue affected all installations, not only systems installed via Kickstart. A '/root/anaconda-ks.cfg' file is created by all installation types.

This updated sos package also includes numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

All users of sos are advised to upgrade to this updated package, which contains backported patches to correct these issues and add these enhancements.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0958 advisory.

  - sosreport does not blank root password in anaconda plugin (CVE-2012-2664)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
69167	Scientific Linux Security Update : sos on SL5.x (noarch) (20130730)	Nessus	Scientific Linux Local Security Checks	medium
69162	RHEL 5 : sos (RHSA-2013:1121)	Nessus	Red Hat Local Security Checks	medium
69159	Oracle Linux 5 : sos (ELSA-2013-1121)	Nessus	Oracle Linux Local Security Checks	critical
69144	CentOS 5 : sos (CESA-2013:1121)	Nessus	CentOS Local Security Checks	medium
68562	Oracle Linux 6 : sos (ELSA-2012-0958)	Nessus	Oracle Linux Local Security Checks	critical
61350	Scientific Linux Security Update : sos on SL6.x (20120620)	Nessus	Scientific Linux Local Security Checks	medium
59933	CentOS 6 : sos (CESA-2012:0958)	Nessus	CentOS Local Security Checks	medium
59598	RHEL 6 : sos (RHSA-2012:0958)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-2664

high

Tenable Plugins

medium

medium

critical

medium

critical

medium

medium

critical