CVE-2016-4996

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.

CVSS v3 7.0 HIGH
CVSS v2.0 1.9 LOW

7.0^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2018:0336	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349136	Issue Tracking Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0336	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349136	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

History

21 Nov 2024, 02:53

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/errata/RHSA-2018:0336 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2018:0336 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1349136 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1349136 - Issue Tracking, Third Party Advisory

Information

Published : 2017-07-17 13:18

Updated : 2024-11-21 02:53

NVD link : CVE-2016-4996

Mitre link : CVE-2016-4996

CVE.ORG link : CVE-2016-4996

JSON object : View

Products Affected

redhat

enterprise_linux_server
satellite

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2016-4996", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2017-07-17T13:18:06.170", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:0336", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349136", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2018:0336", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349136", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en el descovery-debug en Foreman versi\u00f3n anterior a 6.2 cuando el servicio ssh se ha habilitado en los nodos descubiertos muestra la contrase\u00f1a de tipo root en texto plano del sistema cuando se usa para iniciar sesi\u00f3n, lo que permite a los usuarios locales con acceso al System Journal puedan obtener la contrase\u00f1a de tipo root leyendo El System Journal, o haciendo clic en Registros en la consola."}], "lastModified": "2024-11-21T02:53:23.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87F6E32E-6AF3-489A-AFEF-D5309E0D1779"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secalert@redhat.com"}