Test ID:	1.3.6.1.4.1.25623.1.0.64178
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2008:0002
Summary:	Redhat Security Advisory RHSA-2008:0002
Description:	The remote host is missing updates announced in advisory RHSA-2008:0002. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent DMTF standard that defines a common information model, and communication protocol for monitoring and controlling resources. During a security audit, a stack buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges. (CVE-2008-0003) Note that the tog-pegasus packages are not installed by default on Red Hat Enterprise Linux. The Red Hat Security Response Team believes that it would be hard to remotely exploit this issue to execute arbitrary code, due to the default SELinux targeted policy on Red Hat Enterprise Linux 4 and 5, and the SELinux memory protection tests enabled by default on Red Hat Enterprise Linux 5. Users of tog-pegasus should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages the tog-pegasus service should be restarted. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2008-0002.html http://www.redhat.com/security/updates/classification/#critical
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0003 Bugtraq: 20080416 VMSA-2008-0007 Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus (Google Search) http://www.securityfocus.com/archive/1/archive/1/490917/100/0/threaded http://lists.vmware.com/pipermail/security-announce/2008/000014.html https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00424.html https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00480.html HPdes Security Advisory: HPSBMA02331 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01438409 HPdes Security Advisory: SSRT080000 http://www.redhat.com/support/errata/RHSA-2008-0002.html http://www.attrition.org/pipermail/vim/2008-January/001879.html BugTraq ID: 27172 http://www.securityfocus.com/bid/27172 BugTraq ID: 27188 http://www.securityfocus.com/bid/27188 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10282 http://www.vupen.com/english/advisories/2008/0063 http://www.vupen.com/english/advisories/2008/0638 http://www.vupen.com/english/advisories/2008/1234/references http://www.vupen.com/english/advisories/2008/1391/references http://osvdb.org/40082 http://securitytracker.com/id?1019159 http://secunia.com/advisories/28338 http://secunia.com/advisories/28462 http://secunia.com/advisories/29056 http://secunia.com/advisories/29785 http://secunia.com/advisories/29986 XForce ISS Database: openpegasus-pambasic-bo(39527) http://xforce.iss.net/xforce/xfdb/39527
Copyright	Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: