Vulnerabilities > CVE-2008-4315 - Unspecified vulnerability in Redhat Enterprise Linux and Enterprise Linux Desktop

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
redhat
nessus
NVD
Published: 2008-11-27
Updated: 2024-11-21

Summary

tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.

Vulnerable Configurations

Part Description Count
OS
Redhat
2
Application
Openpegasus
1

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-1001.NASL
    descriptionFrom Red Hat Security Advisory 2008:1001 : Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources. Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file
    last seen2020-06-01
    modified2020-06-02
    plugin id67770
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67770
    titleOracle Linux 5 : tog-pegasus (ELSA-2008-1001)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-1001.NASL
    descriptionUpdated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources. Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file
    last seen2020-06-01
    modified2020-06-02
    plugin id34956
    published2008-11-25
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34956
    titleRHEL 5 : tog-pegasus (RHSA-2008:1001)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20081125_TOG_PEGASUS_ON_SL5_X.NASL
    descriptionScientific Linux defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. After re-basing to version 2.7.0 of the OpenGroup Pegasus code, these additional security enhancements were no longer being applied. As a consequence, access to OpenPegasus WBEM services was not restricted to the dedicated users. An attacker able to authenticate using a valid user account could use this flaw to send requests to WBEM services. (CVE-2008-4313) Note: default SELinux policy prevents tog-pegasus from modifying system files. This flaw
    last seen2020-06-01
    modified2020-06-02
    plugin id60499
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60499
    titleScientific Linux Security Update : tog-pegasus on SL5.x i386/x86_64
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-1001.NASL
    descriptionUpdated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources. Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file
    last seen2020-06-01
    modified2020-06-02
    plugin id43717
    published2010-01-06
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43717
    titleCentOS 5 : tog-pegasus (CESA-2008:1001)

Oval

accepted2013-04-29T04:19:21.914-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptiontog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.
familyunix
idoval:org.mitre.oval:def:9431
statusaccepted
submitted2010-07-09T03:56:16-04:00
titletog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.
version18

Redhat

advisories
bugzilla
id472017
titleCVE-2008-4315 tog-pegasus: failed authentication attempts not logged via PAM
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 5 is installed
      ovaloval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • commenttog-pegasus-devel is earlier than 2:2.7.0-2.el5_2.1
          ovaloval:com.redhat.rhsa:tst:20081001001
        • commenttog-pegasus-devel is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080002009
      • AND
        • commenttog-pegasus is earlier than 2:2.7.0-2.el5_2.1
          ovaloval:com.redhat.rhsa:tst:20081001003
        • commenttog-pegasus is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080002011
rhsa
idRHSA-2008:1001
released2008-11-25
severityImportant
titleRHSA-2008:1001: tog-pegasus security update (Important)
rpms
  • tog-pegasus-2:2.7.0-2.el5_2.1
  • tog-pegasus-debuginfo-2:2.7.0-2.el5_2.1
  • tog-pegasus-devel-2:2.7.0-2.el5_2.1

References