CVE-2008-4313: Medium severity red hat enterprise linux vulnerability

Description of problem:

While investigating bug 459057 I noticed that the tog-pegasus RPM based on Pegasus 2.7.0 no longer sets the PAM tty name to "wbemLocal" or "wbemRemote" as in previous releases. It's always set to the service name, "wbem". I believe this completely bypasses the security settings in /etc/Pegasus/access.conf.

To test, install the 2.7.0 RPM and enumerate the PGComputerSystem instance as root. By default this should not work, but it does. If you change the access.conf file from:

-: ALL EXCEPT pegasus:wbemNetwork

to:

-: ALL EXCEPT pegasus:wbem

and retry accessing PGComputerSystem, the request fails as it is supposed to.

Looking at the differences between the local-or-remote-auth patch in tog-pegasus-2.6.1-2.el5.src.rpm vs tog-pegasus-2.7.0-2.el5.src.rpm, it appears that both patches pass whether the connection is remote further down through various Pegasus classes, but the 2.7.0 patch looks like it's missing a whole chunk of code in Security/Authentication/PAMBasicAuthenticatorUnix.cpp where the isRemoteUser parameter is unused.

Tested on ia64 system upgraded from rhel5.0 to rhel5.2 and freshly installed rhel5.2 on x8664.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce: 1. 2. 3. Actual results:

Expected results:

Additional info:

— Red Hat