script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0547 advisory.

    Red Hat CloudForms is an on-premise hybrid cloud     Infrastructure-as-a-Service (IaaS) product that lets you create and manage     private and public clouds. It provides self-service computing resources to     users in a managed, governed, and secure way. CloudForms System Engine can     be used to configure new systems, subscribe to updates, and maintain     installations in distributed environments.

    It was found that the     /usr/share/katello/script/katello-generate-passphrase utility, which is     run during the installation and configuration process, set world-readable     permissions on the /etc/katello/secure/passphrase file. A local attacker     could use this flaw to obtain the passphrase for Katello, giving them     access to information they would otherwise not have access to.
    (CVE-2012-5561)

    Note: After installing this update, ensure the     /etc/katello/secure/passphrase file is owned by the root user and group     and mode 0750 permissions. Sites should also consider re-creating the     Katello passphrase as this issue exposed it to local users.

    One task the katello-configure utility performs is creating an RPM to be     installed on client machines that need to connect to the Katello server. It     was found that this RPM set world-readable and writable permissions on the     pem file (containing the Certificate Authority certificate) used for     trusting the Katello server. An attacker could use this flaw to perform a     man-in-the-middle attack, allowing them to manage (such as installing and     removing software) Katello client systems. (CVE-2012-6116)

    The CVE-2012-5561 issue was discovered by Aaron Weitekamp of the Red Hat     Cloud Quality Engineering team, and CVE-2012-6116 was discovered by Dominic     Cleal and James Laska of Red Hat.

    This update also fixes the following bugs:

    * The CloudForms System Engine command line tool incorrectly parsed     locales, which caused the following error:

    translation missing: de.activerecord.errors.messages.record_invalid

    This update replaces the controller for setting the locale. The translation     error no longer appears. (BZ#896251)

    * Certain locales did not properly escape certain UI content for new role     creation. This broke the Save button for some locales. This update corrects     the escape behavior for localized UI content. The Save button now works     for new role creation. (BZ#896252)

    * A missing icon stopped users from deleting recent or saved searches. This     update adds the icon and users can now delete recent or saved searches.
    (BZ#896253)

    * A performance issue in the Candlepin 0.7.8 component caused subscription     responsiveness to decrease as the number of systems subscribed to     CloudForms System Engine increases. This erratum updates to Candlepin     0.7.19, which corrects the performance issues. (BZ#896261)

    * CloudForms System Engine would not fetch Extended Update Service (EUS)     entitlements. This blocked the user from seeing and enabling EUS     repositories. This update revises the manifest upload and deletion code,     which also corrects the behavior for fetching entitlements. System Engine     now fetches EUS entitlements. (BZ#896265)

    * Issues with menu widths caused the localized UI to not render certain     menu items. This update corrects the style for the System Engine UI. The     Web UI now renders the menu items correctly. (BZ#903702)

    Refer to the CloudForms 1.1.2 Release Notes for further information about     this release. The Release Notes will be available shortly from     https://access.redhat.com/knowledge/docs/

    To upgrade, follow the upgrade instructions in the CloudForms Installation     Guide, section 4.1. Upgrading CloudForms System Engine:

    https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html

    Users of CloudForms System Engine are advised to upgrade to these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines.

It was discovered that Katello did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to download consumer certificates or change settings of other users' systems if they knew the target system's UUID.
(CVE-2012-5603)

A vulnerability in rubygem-ldap_fluff allowed a remote attacker to bypass authentication and log into Subscription Asset Manager when a Microsoft Active Directory server was used as the back-end authentication server. (CVE-2012-5604)

It was found that the '/usr/share/katello/script/katello-generate-passphrase' utility, which is run during the installation and configuration process, set world-readable permissions on the '/etc/katello/secure/passphrase' file. A local attacker could use this flaw to obtain the passphrase for Katello, giving them access to information they would otherwise not have access to. (CVE-2012-5561)

Note: After installing this update, ensure the '/etc/katello/secure/passphrase' file is owned by the root user and group and mode 0750 permissions. Sites should also consider re-creating the Katello passphrase as this issue exposed it to local users.

Three flaws were found in rubygem-rack. A remote attacker could use these flaws to perform a denial of service attack against applications using rubygem-rack. (CVE-2012-6109, CVE-2013-0183, CVE-2013-0184)

A flaw was found in the way rubygem-activerecord dynamic finders extracted options from method parameters. A remote attacker could possibly use this flaw to perform SQL injection attacks against applications using the Active Record dynamic finder methods.
(CVE-2012-6496)

It was found that ruby_parser from rubygem-ruby_parser created a temporary file in an insecure way. A local attacker could use this flaw to perform a symbolic link attack, overwriting arbitrary files accessible to the application using ruby_parser. (CVE-2013-0162)

The CVE-2012-5603 issue was discovered by Lukas Zapletal of Red Hat;
CVE-2012-5604 was discovered by Og Maciel of Red Hat; CVE-2012-5561 was discovered by Aaron Weitekamp of the Red Hat Cloud Quality Engineering team; and CVE-2013-0162 was discovered by Michael Scherer of the Red Hat Regional IT team.

These updated Subscription Asset Manager packages include a number of bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Refer to the Red Hat Subscription Asset Manager 1.2 Release Notes for information about these changes :

https://access.redhat.com/knowledge/docs/en-US/ Red_Hat_Subscription_Asset_Manager/1.2/html/Release_Notes/index.html

All users of Red Hat Subscription Asset Manager are advised to upgrade to these updated packages, which fix these issues and add various enhancements.

ID	Name	Product	Family	Severity
210166	RHEL 6 : CloudForms System Engine 1.1.2 update (Moderate) (RHSA-2013:0547)	Nessus	Red Hat Local Security Checks	medium
65172	RHEL 6 : Subscription Asset Manager (RHSA-2013:0544)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2012-5561

medium

Tenable Plugins

medium

high