CVE-2011-3588
Description
From CVE.org
The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.7 | 5.7 | N/A |
| Attack Vector | Adjacent Network | Adjacent Network | N/A |
| Access Complexity | Medium | Medium | N/A |
| Authentication | None | None | N/A |
| Confidentiality Impact | Complete | Complete | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: AV:A/AC:M/Au:N/C:C/I:N/A:N
NVD: AV:A/AC:M/Au:N/C:C/I:N/A:N
Acknowledgements
Red Hat would like to thank Kevan Carstensen for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
