Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1064 advisory.

  - 3: logs from a deleted namespace can be revealed if a new namespace with the same name is created     (CVE-2016-2149)

  - Privilege escalation when changing root password in sti builder image (CVE-2016-2160)

  - haproxy: Setting cookie containing internal IP address of a pod (CVE-2016-3711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1064 advisory.

    OpenShift Enterprise by Red Hat is the company's cloud computing Platform- as-a-Service (PaaS) solution     designed for on-premise or private cloud deployments.

    Security Fix(es):

    * A flaw was found in the building of containers within OpenShift Enterprise. An attacker could submit an     image for building that executes commands within the container as root, allowing them to potentially     escalate privileges. (CVE-2016-2160)

    * It was found that OpenShift Enterprise would disclose log file contents from reclaimed namespaces. An     attacker could create a new namespace to access log files present in a previously deleted namespace using     the same name. (CVE-2016-2149)

    * An information disclosure flaw was discovered in haproxy as used by OpenShift Enterprise; a cookie with     the name OPENSHIFT_[namespace]_SERVERID was set, which contained the internal IP address of a pod.
    (CVE-2016-3711)

    The CVE-2016-2149 issue was discovered by Wesley Hearn (Red Hat).

    Additional Changes:

    * Space precludes documenting all of the bug fixes and enhancements in this advisory. For details on all     new features, bug fixes, and known issues, see the OpenShift Enterprise 3.2 Release Notes linked to in the     References section.

    This update includes the following images:

    openshift3/ose:v3.2.0.20-3     openshift3/ose-deployer:v3.2.0.20-3     openshift3/ose-docker-builder:v3.2.0.20-3     openshift3/ose-docker-registry:v3.2.0.20-3     openshift3/ose-f5-router:v3.2.0.20-3     openshift3/ose-haproxy-router:v3.2.0.20-3     openshift3/ose-keepalived-ipfailover:v3.2.0.20-3     openshift3/ose-pod:v3.2.0.20-3     openshift3/ose-recycler:v3.2.0.20-3     openshift3/ose-sti-builder:v3.2.0.20-3     openshift3/image-inspector:1.0.0-12     openshift3/jenkins-1-rhel7:1.642-31     openshift3/logging-auth-proxy:3.2.0-3     openshift3/logging-deployment:3.2.0-8     openshift3/logging-elasticsearch:3.2.0-7     openshift3/logging-fluentd:3.2.0-6     openshift3/logging-kibana:3.2.0-3     openshift3/metrics-cassandra:3.2.0-4     openshift3/metrics-deployer:3.2.0-5     openshift3/metrics-hawkular-metrics:3.2.0-6     openshift3/metrics-heapster:3.2.0-5     openshift3/mongodb-24-rhel7:2.4-27     openshift3/mysql-55-rhel7:5.5-25     openshift3/nodejs-010-rhel7:0.10-34     openshift3/node:v3.2.0.20-3     openshift3/openvswitch:v3.2.0.20-4     openshift3/perl-516-rhel7:5.16-37     openshift3/php-55-rhel7:5.5-34     openshift3/postgresql-92-rhel7:9.2-24     openshift3/python-33-rhel7:3.3-34     openshift3/ruby-20-rhel7:2.0-34

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
311952	RHCOS 3 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1064)	Nessus	Red Hat Local Security Checks	Local	high
119372	RHEL 7 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1064)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2016-2160

high

Tenable Plugins

high

high