RHEL 6 : MRG (RHSA-2014:0858)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated cumin package that fixes two security issues is now
available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux
6.

The Red Hat Security Response Team has rated this update as having
Moderate security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a
next-generation IT infrastructure for enterprise computing. MRG offers
increased performance, reliability, interoperability, and faster
computing for enterprise customers.

It was found that if Cumin were asked to display a link name
containing non-ASCII characters, the request would terminate with an
error. If data containing non-ASCII characters were added to the
database (such as via Cumin or Wallaby), requests to load said data
would terminate and the requested page would not be displayed until an
administrator cleans the database. (CVE-2012-2682)

It was found that Cumin did not set the HttpOnly flag on session
cookies. This could allow a malicious script to access the session
cookie. (CVE-2014-0174)

These issues were discovered by Stanislav Graf of Red Hat.

All users of cumin with Red Hat Enterprise MRG 2.5 for Red Hat
Enterprise Linux 6 are advised to upgrade to this updated package,
which corrects these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2012-2682.html
https://www.redhat.com/security/data/cve/CVE-2014-0174.html
http://rhn.redhat.com/errata/RHSA-2014-0858.html

Solution :

Update the affected cumin package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 76678 ()

Bugtraq ID: 69254

CVE ID: CVE-2012-2682
CVE-2014-0174

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now