Test ID:	1.3.6.1.4.1.25623.1.0.64178
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2008:0002
Summary:	The remote host is missing updates announced in;advisory RHSA-2008:0002.
Description:	Summary: The remote host is missing updates announced in advisory RHSA-2008:0002. Vulnerability Insight: The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent DMTF standard that defines a common information model, and communication protocol for monitoring and controlling resources. During a security audit, a stack buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges. (CVE-2008-0003) Note that the tog-pegasus packages are not installed by default on Red Hat Enterprise Linux. The Red Hat Security Response Team believes that it would be hard to remotely exploit this issue to execute arbitrary code, due to the default SELinux targeted policy on Red Hat Enterprise Linux 4 and 5, and the SELinux memory protection tests enabled by default on Red Hat Enterprise Linux 5. Users of tog-pegasus should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages the tog-pegasus service should be restarted. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0003 BugTraq ID: 27172 http://www.securityfocus.com/bid/27172 BugTraq ID: 27188 http://www.securityfocus.com/bid/27188 Bugtraq: 20080416 VMSA-2008-0007 Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus (Google Search) http://www.securityfocus.com/archive/1/490917/100/0/threaded https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00424.html https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00480.html HPdes Security Advisory: HPSBMA02331 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01438409 HPdes Security Advisory: SSRT080000 http://lists.vmware.com/pipermail/security-announce/2008/000014.html http://osvdb.org/40082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10282 http://www.redhat.com/support/errata/RHSA-2008-0002.html http://securitytracker.com/id?1019159 http://secunia.com/advisories/28338 http://secunia.com/advisories/28462 http://secunia.com/advisories/29056 http://secunia.com/advisories/29785 http://secunia.com/advisories/29986 http://www.attrition.org/pipermail/vim/2008-January/001879.html http://www.vupen.com/english/advisories/2008/0063 http://www.vupen.com/english/advisories/2008/0638 http://www.vupen.com/english/advisories/2008/1234/references http://www.vupen.com/english/advisories/2008/1391/references XForce ISS Database: openpegasus-pambasic-bo(39527) https://exchange.xforce.ibmcloud.com/vulnerabilities/39527
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.