The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The installation script in Katello 1.0 and earlier does not properly generate the
    Application.config.secret_token value, which causes each default installation to have the same secret
    token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an
    arbitrary user by creating a cookie using the default secret_token. (CVE-2012-3503)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1186 advisory.

    Katello allows you to manage the application life-cycle for Linux systems.
    Katello is used by CloudForms System Engine, an Infrastructure as a Service     (IaaS) application that provides tools to update and monitor systems within     private and hybrid clouds, and can be used to configure new systems,     subscribe to updates, and maintain installations in distributed     environments.

    It was found that the katello-common package's installation script did not     correctly generate the secret token used for session cookie generation,     leading to every default installation using the same secret token. A remote     attacker could use this flaw to create a cookie that would allow them to     log into the CloudForms System Engine web interface as any user, without     knowing the passwords. (CVE-2012-3503)

    All users of Red Hat CloudForms are advised to upgrade to these updated     packages, which correct this issue. For instructions on applying this     update, refer to the CloudForms Release Notes, linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1187 advisory.

    Katello allows you to manage the application life-cycle for Linux systems.
    Katello is used by Red Hat Subscription Asset Manager, a distributor     application for handling subscription information and software updates on     client machines.

    It was found that the katello-common package's installation script did not     correctly generate the secret token used for session cookie generation,     leading to every default installation using the same secret token. A remote     attacker could use this flaw to create a cookie that would allow them to     log into the Subscription Asset Manager web interface as any user, without     knowing the passwords. (CVE-2012-3503)

    All users of Red Hat Subscription Asset Manager are advised to upgrade to     these updated packages, which correct this issue. For instructions on     applying this update, refer to the Subscription Asset Manager Installation     Guide, linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
432806	SCA: security update for katello (GHSA-5xv2-q475-rwrh)	Tenable Cloud Security	SCA Checks	critical
432806	SCA: security update for katello (GHSA-5xv2-q475-rwrh)	Tenable Self-Hosted Container Security	SCA Checks	critical
193980	RHEL 6 : katello (RHSA-2012:1186)	Nessus	Red Hat Local Security Checks	critical
64052	RHEL 6 : katello (RHSA-2012:1187)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-3503

critical

Tenable Plugins

critical

critical

critical

critical