SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Red Hat CloudForms Vendors:   Red Hat
Red Hat CloudForms Directory Traversal Flaw Lets Remote Users Upload and Execute Arbitrary Code
SecurityTracker Alert ID:  1028976
SecurityTracker URL:  http://securitytracker.com/id/1028976
CVE Reference:   CVE-2013-2068   (Links to External Site)
Date:  Sep 4 2013
Impact:   Execution of arbitrary code via network, Modification of system information, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): CloudForms Management Engine 2.0
Description:   A vulnerability was reported in Red Hat CloudForms. A remote user can execute arbitrary code on the target system.

The Management Engine contains directory traversal flaws. A remote user can exploit this to upload arbitrary code and cause the code to be executed with root privileges on the target system.

A demonstration exploit URL is provided:

https://[target]/agent/log?&id=8dfc29fe-a118-11e2-805c-005056920a2c&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJwrKM9LTQEABokCHw==

Ramon de C Valle of the Red Hat Product Security Team reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system with root privileges.
Solution:   The vendor has issued a fix.

[Editor's note: The fix was silently included in the fixpack released as part of RHSA-2013:1157.]

The vendor's advisory is available at:

https://rhn.redhat.com/errata/RHSA-2013-1206.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2013-1206.html (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Any)

Message History:   None.


 Source Message Contents

Subject:  [RHSA-2013:1206-01] Critical: Red Hat CloudForms Management Engine security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat CloudForms Management Engine security update
Advisory ID:       RHSA-2013:1206-01
Product:           Red Hat CloudForms
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-1206.html
Issue date:        2013-09-04
CVE Names:         CVE-2013-2068 
=====================================================================

1. Summary:

The RHSA-2013:1157 update for Red Hat CloudForms Management Engine included
an additional fix that was not documented in the erratum.

The Red Hat Security Response Team has rated this update as having
critical security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Description:

Red Hat CloudForms Management Engine provides the insight, control, and
automation needed to address the challenges of managing virtual
environments.

Multiple directory traversal flaws were found in Red Hat CloudForms
Management Engine. A remote, unauthenticated attacker could use these flaws
to upload arbitrary code, and have that code executed with root privileges
on Red Hat CloudForms Management Engine. (CVE-2013-2068)

This issue was discovered by Ramon de C Valle of the Red Hat Product
Security Team.

Note: This issue was already addressed in the fixpack released as part of
RHSA-2013:1157, however it was not documented and therefore the erratum was
incorrectly rated as having important security impact. No new packages are
available in this erratum; please install the fixpack as noted in
RHSA-2013:1157.

Refer to the Solution section of this erratum for installation
instructions.

3. Solution:

The update is provided in a fixpack, available from:

https://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=17971

To install the fixpack, follow the instructions in the following Red Hat
Knowledge Base article:

https://access.redhat.com/site/articles/450563

4. Bugs fixed (http://bugzilla.redhat.com/):

960422 - CVE-2013-2068 CFME 2.0 multiple zip file upload path traversal vulnerabilities

5. References:

https://www.redhat.com/security/data/cve/CVE-2013-2068.html
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/site/articles/450563
https://access.redhat.com/site/documentation/en-US/CloudForms/2.0/html/Management_Engine_5.1_Technical_Notes/index.html
https://rhn.redhat.com/errata/RHSA-2013-1157.html

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFSJ4PGXlSAg2UNWIIRAtzcAKCa4rEE/P0NvPF/rhY6vlwl81XpKACeIiue
OSljXQiKwn6Pwlevj2DnpWU=
=UTMt
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC