RHEL 6 : Virtualization Manager (RHSA-2013:0888)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Red Hat Enterprise Virtualization Manager 3.2 is now available.

The Red Hat Security Response Team has rated this update as having
moderate security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from
the CVE link in the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for
centrally managing collections of virtual servers running Red Hat
Enterprise Linux and Microsoft Windows. This package also includes the
Red Hat Enterprise Virtualization Manager API, a set of scriptable
commands that give administrators the ability to perform queries and
operations on Red Hat Enterprise Virtualization Manager.

It was found that permission checks were not performed on the target
storage domain when cloning a virtual machine from a snapshot. An
attacker could use this flaw to perform a denial of service attack,
exhausting free disk space on the target storage domain.
(CVE-2013-2144)

The CVE-2013-2144 issue was discovered by Daniel Erez of Red Hat.

This update also fixes various bugs. Refer to the Technical Notes for
information about these changes :

https://access.redhat.com/site/documentation/en-US/
Red_Hat_Enterprise_Virtualization/3.2/html/Technical_Notes/
chap-RHSA-2013-0888.html

All Red Hat Enterprise Virtualization Manager users are advised to
upgrade to these updated packages, which resolve these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2013-2144.html
https://access.redhat.com/site/documentation/en-US/
http://rhn.redhat.com/errata/RHSA-2013-0888.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 3.7
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Red Hat Local Security Checks

Nessus Plugin ID: 78960 ()

Bugtraq ID: 61028

CVE ID: CVE-2013-2144

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now