Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-4083 | First vendor Publication | 2014-02-17 |
| Vendor | Cve | Last vendor Modification | 2014-02-19 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4083 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-310 | Cryptographic Issues |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:21308 | |||
| Oval ID: | oval:org.mitre.oval:def:21308 | ||
| Title: | RHSA-2012:0153: sos security, bug fix, and enhancement update (Low) | ||
| Description: | The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:0153-03 CESA-2012:0153 CVE-2011-4083 | Version: | 7 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | sos |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:21889 | |||
| Oval ID: | oval:org.mitre.oval:def:21889 | ||
| Title: | RHSA-2011:1536: sos security, bug fix, and enhancement update (Low) | ||
| Description: | The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:1536-03 CVE-2011-4083 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | sos |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22918 | |||
| Oval ID: | oval:org.mitre.oval:def:22918 | ||
| Title: | ELSA-2012:0153: sos security, bug fix, and enhancement update (Low) | ||
| Description: | The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:0153-03 CVE-2011-4083 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | sos |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23283 | |||
| Oval ID: | oval:org.mitre.oval:def:23283 | ||
| Title: | ELSA-2011:1536: sos security, bug fix, and enhancement update (Low) | ||
| Description: | The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:1536-03 CVE-2011-4083 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | sos |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27580 | |||
| Oval ID: | oval:org.mitre.oval:def:27580 | ||
| Title: | DEPRECATED: ELSA-2012-0153 -- sos security, bug fix, and enhancement update (low) | ||
| Description: | [1.7-9.62.0.1.el5] - add patch to remove all sysrq echo commands from sysreport.legacy (John Sobecki) [orabug 11061754] - comment out rh-upload-core and README.rh-upload-core in specfile | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0153 CVE-2011-4083 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | sos |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27995 | |||
| Oval ID: | oval:org.mitre.oval:def:27995 | ||
| Title: | DEPRECATED: ELSA-2011-1536 -- sos security, bug fix, and enhancement update (low) | ||
| Description: | The sosreport utility incorrectly included Certificate-based Red Hat Network private entitlement keys in the resulting archive of debugging information. An attacker able to access the archive could use the keys to access Red Hat Network content available to the host. This issue did not affect users of Red Hat Network Classic. (CVE-2011-4083) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-1536 CVE-2011-4083 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | sos |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-07-09 | Name : RedHat Update for sos RHSA-2011:1536-03 File : nvt/gb_RHSA-2011_1536-03_sos.nasl |
| 2012-02-21 | Name : RedHat Update for sos RHSA-2012:0153-03 File : nvt/gb_RHSA-2012_0153-03_sos.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2012-0153.nasl - Type : ACT_GATHER_INFO |
| 2013-01-17 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2012-0153.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20111206_sos_on_SL6.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20120221_sos_on_SL5.nasl - Type : ACT_GATHER_INFO |
| 2012-02-21 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2012-0153.nasl - Type : ACT_GATHER_INFO |
| 2011-12-06 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2011-1536.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
| Source | Url |
|---|---|
| REDHAT | http://rhn.redhat.com/errata/RHSA-2011-1536.html http://rhn.redhat.com/errata/RHSA-2012-0153.html |
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:17:46 |
|
| 2021-04-22 01:21:03 |
|
| 2020-05-23 01:47:26 |
|
| 2020-05-23 00:32:07 |
|
| 2014-02-19 13:22:09 |
|
| 2014-02-17 21:21:06 |
|
