VulnerabilityModified
CVE-2008-4313
A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.
MEDIUM 6.0EPSS 1.41%
Does this matter?
Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.
Description
A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- redhat/enterprise linux · redhat/enterprise linux desktop
- Source
- secalert@redhat.com
References
- http://osvdb.org/50277
- http://secunia.com/advisories/32862Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1001.html
- http://www.securityfocus.com/bid/32460
- http://www.securitytracker.com/id?1021283
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.0-7.fc9
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.1-3.fc10Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=459217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46829
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9556
- http://osvdb.org/50277
- http://secunia.com/advisories/32862Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-1001.html
- http://www.securityfocus.com/bid/32460
- http://www.securitytracker.com/id?1021283
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.0-7.fc9
- https://admin.fedoraproject.org/updates/tog-pegasus-2.7.1-3.fc10Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=459217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46829
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9556
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.