#VU7662 Information disclosure in Red Hat Enterprise Linux for x86_64 - CVE-2017-7488

Vulnerability identifier: #VU7662

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7488

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Red Hat Enterprise Linux for x86_64
Operating systems & Components / Operating system

Vendor: Red Hat Inc.

Description
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper configuration of the System Security Services Daemon (SSSD) by the authconfig feature. A remote attacker can use SSSD to authenticate against remote server, conduct a timing attack and read arbitrary files that may be used to conduct further attacks.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for x86_64: 7.0

---

External links
https://access.redhat.com/security/cve/CVE-2017-7488

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.