RHEL 6 : rhev-3.1.0 vdsm (RHSA-2012:1508)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated vdsm packages are now available for Red Hat Enterprise Linux
6.3.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

VDSM is a management module that serves as a Red Hat Enterprise
Virtualization Manager agent on Red Hat Enterprise Virtualization
Hypervisor or Red Hat Enterprise Linux 6.3 hosts.

A flaw was found in the way Red Hat Enterprise Linux hosts were added
to the Red Hat Enterprise Virtualization environment. The Python
scripts needed to configure the host for Red Hat Enterprise
Virtualization were stored in the '/tmp/' directory and could be
pre-created by an attacker. A local, unprivileged user on the host to
be added to the Red Hat Enterprise Virtualization environment could
use this flaw to escalate their privileges. This update provides the
VDSM part of the fix. The RHSA-2012:1506 Red Hat Enterprise
Virtualization Manager update must also be installed to completely fix
this issue. (CVE-2012-0860)

A flaw was found in the way Red Hat Enterprise Linux and Red Hat
Enterprise Virtualization Hypervisor hosts were added to the Red Hat
Enterprise Virtualization environment. The Python scripts needed to
configure the host for Red Hat Enterprise Virtualization were
downloaded in an insecure way, that is, without properly validating
SSL certificates during HTTPS connections. An attacker on the local
network could use this flaw to conduct a man-in-the-middle attack,
potentially gaining root access to the host being added to the Red Hat
Enterprise Virtualization environment. This update provides the VDSM
part of the fix. The RHSA-2012:1506 Red Hat Enterprise Virtualization
Manager update must also be installed to completely fix this issue.
(CVE-2012-0861)

The CVE-2012-0860 and CVE-2012-0861 issues were discovered by Red Hat.

In addition to resolving the above security issues these updated VDSM
packages fix various bugs, and add various enhancements.

Documentation for these bug fixes and enhancements is available in the
Technical Notes :

https://access.redhat.com/knowledge/docs/en-US/
Red_Hat_Enterprise_Virtualization/3.1/html/Technical_Notes/index.html

All users who require VDSM are advised to install these updated
packages which resolve these security issues, fix these bugs, and add
these enhancements.

See also :

https://www.redhat.com/security/data/cve/CVE-2012-0860.html
https://www.redhat.com/security/data/cve/CVE-2012-0861.html
https://access.redhat.com/knowledge/docs/en-US/
http://rhn.redhat.com/errata/RHSA-2012-1508.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.0
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Red Hat Local Security Checks

Nessus Plugin ID: 78941 ()

Bugtraq ID: 56825

CVE ID: CVE-2011-4316
CVE-2012-0860
CVE-2012-0861

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now