Title: OpenPegasus WBEM CIM Management Server 'PAMBasicAuthenticatorUnix.cpp' Buffer Overflow Vulnerability
Severity: CRITICAL
Description:
OpenPegasus is an implementation of these standards:
DMTF (Distributed Management Task Force)
CIM (Common Information Model)
WBEM (Web-Based Enterprise Management)
These standards define an information model and communication protocol for managing server resources.
The OpenPegasus CIM management server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
The issue affects the 'PAMBasicAuthenticator::PAMCallback()' function of the 'PAMBasicAuthenticatorUnix.cpp' PAM (Pluggable Authentication Module) authentication code when handling 'mydata->userPassword' data.
Attackers can leverage this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions.
Versions in the OpenPegasus 2.6 series are vulnerable.
Affected Products:
- Avaya Intuity AUDIX LX 2.0
- Avaya Message Networking MN 3.1
- HP HP-UX 11.0.0
- HP HP-UX 11.11.0
- HP HP-UX 11.23.0
- HP HP-UX B.11.11
- HP HP-UX B.11.23
- HP HP-UX B.11.31
- HP HP-UX B.11.31
- HP WBEM A.02.05.08
- HP WBEM A.02.07
- IBM Pegasus CIM Server 2.5.1
- IBM Pegasus CIM Server 2.6.1
- OpenPegasus OpenPegasus 2.6.1
- RedHat Enterprise Linux 5 server
- RedHat Enterprise Linux AS 4
- RedHat Enterprise Linux AS 4.5.z
- RedHat Enterprise Linux Desktop Workstation 5 client
- RedHat Enterprise Linux Desktop version 4
- RedHat Enterprise Linux ES 4
- RedHat Enterprise Linux ES 4.5.z
- RedHat Enterprise Linux WS 4
- RedHat Fedora 7
- RedHat Fedora 8
- VMWare ESX Server 3.5
References:
- Avaya: ASA-2008-028 tog-pegasus security update (RHSA-2008-0002)
- CVE: CVE-2008-0003
- OpenPegasus: Diff for /pegasus/src/Pegasus/Security/Authentication/PAMBasicAuthenticatorUnix.
- OpenPegasus: Vendor Homepage
- Red Hat: Bugzilla Bug 426578: CVE-2008-0003 tog-pegasus pam authentication buffer overfl
- Red Hat: RHSA-2008:0002-7 Critical: tog-pegasus security update
- Roger Kumpf: CVS BUG#:7220 <RELEASE_2_6-branch> Memory error in PAM module
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
