PT-2011-4186 · Red Hat · Red Hat Enterprise Mrg

Vincent Danen · Publicado 2011-09-19 · Atualizado 2021-07-15 · CVE-2011-2925

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Messaging, Realtime, and Grid (MRG) version 2.0

Description The issue allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker. This is possible because broker authentication credentials are recorded in a log file.

Recommendations For Red Hat Enterprise Messaging, Realtime, and Grid (MRG) version 2.0, consider restricting access to the log files that contain broker authentication credentials to minimize the risk of exploitation. Additionally, review and modify the logging configuration to prevent the recording of sensitive authentication credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-2925

RHSA-2011:1249

RHSA-2011:1250

Produtos afetados

Red Hat Enterprise Mrg

Referências · 11

• https://t.me/cvenotify/17695 · Publicação no Telegram
• http://redhat.com/support/errata/RHSA-2011-1249.html · Aviso do Fabricante
• http://secunia.com/advisories/45887 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=731574 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2925 · Nota de Segurança
• http://osvdb.org/75217 · Nota
• http://redhat.com/support/errata/RHSA-2011-1250.html · Aviso do Fabricante
• http://securitytracker.com/id?1026021 · Nota
• http://secunia.com/advisories/45928 · Aviso do Fabricante
• http://securityfocus.com/bid/49500 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69659 · Nota