CVE-2011-3588

The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as
distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before
2.0.0-209 packages in Red Hat Enterprise Linux, disables the
StrictHostKeyChecking option, which allows man-in-the-middle attackers to
spoof kdump servers, and obtain sensitive core information, by using an
arbitrary SSH key.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=716439&gt;

Notes