RHSA-2008:0002Critical

Red Hat Security Advisory: tog-pegasus security update

Published
January 7, 2008
Last Modified
June 25, 2026

🔗 CVE IDs covered (1)

CVE-2008-0003 →

📋 Description

CVE-2008-0003 — tog-pegasus pam authentication buffer overflow

🎯 Affected products139

  • Red Hat Enterprise Linux (v. 5 server)
  • Red Hat Enterprise Linux AS EUS (v. 4.5)
  • Red Hat Enterprise Linux AS version 4
  • Red Hat Enterprise Linux Desktop (v. 5 client)
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client)
  • Red Hat Enterprise Linux Desktop version 4
  • Red Hat Enterprise Linux ES EUS (v. 4.5)
  • Red Hat Enterprise Linux ES version 4
  • Red Hat Enterprise Linux WS version 4
  • tog-pegasus-2:2.5.1-2.el4_5.1.i386 as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.i386 as a component of Red Hat Enterprise Linux ES EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.ia64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.ia64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.ppc as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.s390 as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.s390x as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.src as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.src as a component of Red Hat Enterprise Linux ES EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.x86_64 as a component of Red Hat Enterprise Linux AS EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-2.el4_5.1.x86_64 as a component of Red Hat Enterprise Linux ES EUS (v. 4.5)
  • tog-pegasus-2:2.5.1-5.el4_6.1.i386 as a component of Red Hat Enterprise Linux AS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.i386 as a component of Red Hat Enterprise Linux Desktop version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.i386 as a component of Red Hat Enterprise Linux ES version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.i386 as a component of Red Hat Enterprise Linux WS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.ia64 as a component of Red Hat Enterprise Linux AS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.ia64 as a component of Red Hat Enterprise Linux ES version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.ia64 as a component of Red Hat Enterprise Linux WS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.ppc as a component of Red Hat Enterprise Linux AS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.s390 as a component of Red Hat Enterprise Linux AS version 4
  • tog-pegasus-2:2.5.1-5.el4_6.1.s390x as a component of Red Hat Enterprise Linux AS version 4
  • +109 more not shown

✅ Remediation

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Workaround: The tog-pegasus package is not installed by default on Red Hat Enterprise Linux. tog-pegasus supplied by Red Hat binds only to one port (as plain http is disabled), port 5989. The default firewall installed by Red Hat Enterprise Linux will block remote access to this port. In normal use it's unlikely you'd want to have this port accessible outside of an intranet anyway, and it's likely to be blocked by enterprise border firewalls. However if tog-pegasus has been installed and unblocked through the fireware, the Red Hat Security Response Team believes that it would still be hard to remotely exploit this issue to execute arbitrary code due to the default SELinux targeted policy on Enterprise Linux 4 and 5, and the SELinux memory protections enabled by default on Enterprise Linux 5.

🔗 References (4)