Executive Summary
Summary | |
---|---|
Title | OpenIPMI security, bug fix, and enhancement update |
Informations | |||
---|---|---|---|
Name | RHSA-2013:0123 | First vendor Publication | 2013-01-08 |
Vendor | RedHat | Last vendor Modification | 2013-01-08 |
Severity (Vendor) | Low | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:N/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 3.6 | Attack Range | Local |
Cvss Impact Score | 4.9 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated OpenIPMI packages that fix one security issue, multiple bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The OpenIPMI packages provide command line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. It was discovered that the IPMI event daemon (ipmievd) created its process ID (PID) file with world-writable permissions. A local user could use this flaw to make the ipmievd init script kill an arbitrary process when the ipmievd daemon is stopped or restarted. (CVE-2011-4339) Note: This issue did not affect the default configuration of OpenIPMI as shipped with Red Hat Enterprise Linux 5. This update also fixes the following bugs: * Prior to this update, the ipmitool utility first checked the IPMI hardware for Dell IPMI extensions and listed only supported commands when printing command usage like the option "ipmtool delloem help". On a non-Dell platform, the usage text was incomplete and misleading. This update lists all Dell OEM extensions in usage texts on all platforms, which allows users to check for command line arguments on non-Dell hardware. (BZ#658762) * Prior to this update, the ipmitool utility tried to retrieve the Sensor Data Records (SDR) from the IPMI bus instead of the Baseboard Management Controller (BMC) bus when IPMI-enabled devices reported SDR under a different owner than the BMC. As a consequence, the timeout setting for the SDR read attempt could significantly decrease the performance and no sensor data was shown. This update modifies ipmitool to read these SDR records from the BMC and shows the correct sensor data on these platforms. (BZ#671059, BZ#749796) * Prior to this update, the exit code of the "ipmitool -o list" option was not set correctly. As a consequence, "ipmitool -o list" always returned the value 1 instead of the expected value 0. This update modifies the underlying code to return the value 0 as expected. (BZ#740780) * Prior to this update, the "ipmi" service init script did not specify the full path to the "/sbin/lsmod" and "/sbin/modprobe" system utilities. As a consequence, the init script failed when it was executed if PATH did not point to /sbin, for example, when running "sudo /etc/init.d/ipmi". This update modifies the init script so that it now contains the full path to lsmod and modrpobe. Now, it can be executed with sudo. (BZ#829705) * Prior to this update, the ipmitool man page did not list the "-b", "-B", "-l" and "-T" options. In this update, these options are documented in the ipmitool man page. (BZ#846596) This update also adds the following enhancement: * Updates to the Dell-specific IPMI extension: A new vFlash command, which allows users to display information about extended SD cards; a new setled command, which allows users to display the backplane LED status; improved error descriptions; added support for new hardware; and updated documentation of the ipmitool delloem commands in the ipmitool manual page. (BZ#797050) All users of OpenIPMI are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 658762 - ipmitool delloem accesses IPMI before acting (e.g. listing help) 671059 - bad performance of ipmitool sdr by update to 2.0.16 740780 - ipmitool -o list return always 1 742837 - CVE-2011-4339 OpenIPMI: IPMI event daemon creates PID file with world writeable permissions 749796 - Bad performance for ipmitool sdr in verbose mode 829705 - initscript of ipmi contains incomplete path and cannot start by certain users |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2013-0123.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-732 | Incorrect Permission Assignment for Critical Resource (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:15157 | |||
Oval ID: | oval:org.mitre.oval:def:15157 | ||
Title: | DSA-2376-1 ipmitool -- insecure pid file | ||
Description: | It was discovered that OpenIPMI, the Intelligent Platform Management Interface library and tools, used too wide permissions PID file, which allows local users to kill arbitrary processes by writing to this file. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2376-1 CVE-2011-4339 | Version: | 5 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | ipmitool |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15293 | |||
Oval ID: | oval:org.mitre.oval:def:15293 | ||
Title: | DSA-2376-2 ipmitool -- insecure pid file | ||
Description: | It was discovered that OpenIPMI, the Intelligent Platform Management Interface library and tools, used too wide permissions PID file, which allows local users to kill arbitrary processes by writing to this file. The original announcement didn't contain corrections for the Debian 5.0 "lenny" distribution. This update adds packages for lenny. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2376-2 CVE-2011-4339 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | ipmitool |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20287 | |||
Oval ID: | oval:org.mitre.oval:def:20287 | ||
Title: | RHSA-2013:0123: OpenIPMI security, bug fix, and enhancement update (Low) | ||
Description: | ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2013:0123-00 CESA-2013:0123 CVE-2011-4339 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | OpenIPMI |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22166 | |||
Oval ID: | oval:org.mitre.oval:def:22166 | ||
Title: | RHSA-2011:1814: ipmitool security update (Moderate) | ||
Description: | ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1814-01 CESA-2011:1814 CVE-2011-4339 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | ipmitool |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22807 | |||
Oval ID: | oval:org.mitre.oval:def:22807 | ||
Title: | ELSA-2011:1814: ipmitool security update (Moderate) | ||
Description: | ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1814-01 CVE-2011-4339 | Version: | 6 |
Platform(s): | Oracle Linux 6 | Product(s): | ipmitool |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23486 | |||
Oval ID: | oval:org.mitre.oval:def:23486 | ||
Title: | ELSA-2013:0123: OpenIPMI security, bug fix, and enhancement update (Low) | ||
Description: | ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013:0123-00 CVE-2011-4339 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | OpenIPMI |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27619 | |||
Oval ID: | oval:org.mitre.oval:def:27619 | ||
Title: | DEPRECATED: ELSA-2013-0123 -- OpenIPMI security, bug fix, and enhancement update (low) | ||
Description: | [2.0.16-16.el5] - ipmitool: fix ipmi command retry shifts replies (#863310) [2.0.16-15.el5] - ipmitool: added -b, -B, -l and -T options to ipmitool man page (#846596) - ipmitool: fixed man page documentation for delloem setled command (#797050) [2.0.16-14.el5] - ipmitool: fixed wrong permissions on ipmievd.pid (#834190) [2.0.16-13.el5] - ipmitool: updated delloem commands (#797050) - ipmitool: fixed exit code of 'ipmitool -o list' command (#740780) - ipmitool: disabled automatic bridging of SDR readings to IPMB in verbose mode (#749796) - ipmitool: fixed reporting of usage of various delloem subcommands (#658762) - added path to /sbin to lsmod and modprobe (#829705) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013-0123 CVE-2011-4339 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | OpenIPMI |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27696 | |||
Oval ID: | oval:org.mitre.oval:def:27696 | ||
Title: | DEPRECATED: ELSA-2011-1814 -- ipmitool security update (moderate) | ||
Description: | [1.8.11-12.1] - fixed wrong permissions on ipmievd.pid (#756684) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1814 CVE-2011-4339 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | ipmitool |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2012-07-30 | Name : CentOS Update for ipmitool CESA-2011:1814 centos6 File : nvt/gb_CESA-2011_1814_ipmitool_centos6.nasl |
2012-07-09 | Name : RedHat Update for ipmitool RHSA-2011:1814-01 File : nvt/gb_RHSA-2011_1814-01_ipmitool.nasl |
2012-04-02 | Name : Fedora Update for ipmitool FEDORA-2011-17065 File : nvt/gb_fedora_2011_17065_ipmitool_fc16.nasl |
2012-02-11 | Name : Debian Security Advisory DSA 2376-1 (ipmitool) File : nvt/deb_2376_1.nasl |
2012-02-11 | Name : Debian Security Advisory DSA 2376-2 (ipmitool) File : nvt/deb_2376_2.nasl |
2012-01-09 | Name : Fedora Update for ipmitool FEDORA-2011-17071 File : nvt/gb_fedora_2011_17071_ipmitool_fc15.nasl |
2011-12-30 | Name : Mandriva Update for ipmitool MDVSA-2011:196 (ipmitool) File : nvt/gb_mandriva_MDVSA_2011_196.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
77748 | IMPItool ipmievd PID File Process ID Exchange Local DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ipmitool_20121120.nasl - Type : ACT_GATHER_INFO |
2014-11-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1850.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2011-1814.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0123.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0123.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130108_OpenIPMI_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2013-01-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0123.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111213_ipmitool_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-01-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2376.nasl - Type : ACT_GATHER_INFO |
2012-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2011-17065.nasl - Type : ACT_GATHER_INFO |
2012-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2011-17071.nasl - Type : ACT_GATHER_INFO |
2011-12-29 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2011-196.nasl - Type : ACT_GATHER_INFO |
2011-12-23 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2011-1814.nasl - Type : ACT_GATHER_INFO |
2011-12-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1814.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:56:37 |
|
2013-01-08 09:18:07 |
|