CVE-2011-3588
published 2014-02-15CVE-2011-3588: The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209…
PriorityP422medium5.7CVSS 2.0
AVAACMAuNCCINAN
EPSS
0.54%
42.0th percentile
The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | kexec-tools | — | — |
| redhat | kexec-tools | <= 1.102pre-126 | — |
| redhat | kexec-tools | <= 2.0.0-188 | — |
| suse | kdump | >= unspecified < 2012-01-20 | 2012-01-20 |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
| suse | suse_linux_enterprise_server | — | — |
CVSS provenance
nvdv2.05.7MEDIUMAV:A/AC:M/Au:N/C:C/I:N/A:N
vendor_debian5.7LOW
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-26mg-g7xm-c7ph: The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1
ghsa_unreviewed·2022-05-17
CVE-2011-3588 [MEDIUM] GHSA-26mg-g7xm-c7ph: The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1
The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
GHSA
GHSA-cp9h-xhgc-8r95: The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20
ghsa_unreviewed·2022-05-13·CVSS 5.7
CVE-2011-4190 [MEDIUM] GHSA-cp9h-xhgc-8r95: The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
Red Hat
kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
vendor_redhat·2011-10-05·CVSS 5.7
CVE-2011-3588 [MEDIUM] kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
Debian
CVE-2011-3588: kexec-tools - The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distrib...
vendor_debian·2011·CVSS 5.7
CVE-2011-3588 [MEDIUM] CVE-2011-3588: kexec-tools - The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distrib...
The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images [fedora-all]
bugzilla·2011-10-05·CVSS 5.7
CVE-2011-3588 [MEDIUM] CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images [fedora-all]
CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new
Bugzilla
CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
bugzilla·2011-06-24·CVSS 5.7
CVE-2011-3588 [MEDIUM] CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
Multiple security flaws were found in the way kexec-tools performed management
of created kdump core files and ramdisk images:
* the default value of "StrictHostKeyChecking=no" has been used for kdump /
mkdumprd openssh integration. A remote malicious kdump server could use
this flaw to impersonate the intended, correct kdump server to obtain
security sensitive information (kdump core files),
* mkdumprd utility copied content of certain directories into newly created
initial ramdisk images, potentially leading to information leak,
* mkdumprd utility created the final initial ramdisk image with world-readable
permissions, possibly leading to information leak.
2014-02-15
Published