PT-2011-4186 · Red Hat · Red Hat Enterprise Mrg

Vincent Danen · Published 2011-09-19 · Updated 2021-07-15 · CVE-2011-2925

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Messaging, Realtime, and Grid (MRG) version 2.0

Description The issue allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker. This is possible because broker authentication credentials are recorded in a log file.

Recommendations For Red Hat Enterprise Messaging, Realtime, and Grid (MRG) version 2.0, consider restricting access to the log files that contain broker authentication credentials to minimize the risk of exploitation. Additionally, review and modify the logging configuration to prevent the recording of sensitive authentication credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-2925

RHSA-2011:1249

RHSA-2011:1250

Affected Products

Red Hat Enterprise Mrg

References · 11

• http://redhat.com/support/errata/RHSA-2011-1249.html · Vendor Advisory
• http://secunia.com/advisories/45887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2925 · Security Note
• http://redhat.com/support/errata/RHSA-2011-1250.html · Vendor Advisory
• http://secunia.com/advisories/45928 · Vendor Advisory
• https://t.me/cvenotify/17695 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=731574 · Note
• http://osvdb.org/75217 · Note
• http://securitytracker.com/id?1026021 · Note
• http://securityfocus.com/bid/49500 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69659 · Note