Red Hat has issued an update for kexec-tools. This fixes two security issues, which can be exploited by malicious, local users and malicious people to disclose sensitive information.

1) The security issue is caused due to the mkdumprd utility setting the "StrictHostKeyChecking" SSH-Parameter to "no" when using SSH targets, which can aid the disclosure of e.g. kdump core files by impersonating a kdump SSH server target via Man-in-the-Middle (MitM) attacks.

2) The security issue is caused due to the mkdumprd utility creating an initrd file with world-readable permissions, which can be exploited to disclose the e.g. private SSH key for a remote server when using SSH targets.

Solution
Updated packages are available via Red Hat Network.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Kevan Carstensen.

Changelog
Further details available to Secunia VIM customers

Original Advisory
RHSA-2011:1532-03:
https://rhn.redhat.com/errata/RHSA-2011-1532.html

RHSA-2012:0152-03:
https://rhn.redhat.com/errata/RHSA-2012-0152.html

Red Hat Bug#716439:
https://bugzilla.redhat.com/show_bug.cgi?id=716439

Deep Links
Links available to Secunia VIM customers