Detections
Analytics

RHEL 6 : Virtualization Manager (RHSA-2014:0038)

medium Nessus Plugin ID 78993

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Red Hat Enterprise Virtualization Manager 3.3 is now available.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows. This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.

A flaw was found in the way Red Hat Enterprise Virtualization Manager relayed SPICE connection information to remote-viewer when a native SPICE client invocation method was used. As a result, remote-viewer attempted an insecure connection first and only switched to a secure connection when requested by the SPICE server. An attacker able to intercept the SPICE connection could use this flaw to conduct man-in-the-middle attacks. (CVE-2013-6434)

Red Hat would like to thank Michael Samuel of Amcom for reporting this issue.

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

Solution

Update the affected packages.

See Also

https://access.redhat.com/documentation/en-US/

https://access.redhat.com/errata/RHSA-2014:0038

https://access.redhat.com/security/cve/cve-2013-6434

Plugin Details

Severity: Medium

ID: 78993

File Name: redhat-RHSA-2014-0038.nasl

Version: 1.13

Type: local

Agent: unix

Published: 11/8/2014

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rhevm, p-cpe:/a:redhat:enterprise_linux:rhevm-backend, p-cpe:/a:redhat:enterprise_linux:rhevm-dbscripts, p-cpe:/a:redhat:enterprise_linux:rhevm-lib, p-cpe:/a:redhat:enterprise_linux:rhevm-restapi, p-cpe:/a:redhat:enterprise_linux:rhevm-setup, p-cpe:/a:redhat:enterprise_linux:rhevm-setup-plugin-allinone, p-cpe:/a:redhat:enterprise_linux:rhevm-tools, p-cpe:/a:redhat:enterprise_linux:rhevm-userportal, p-cpe:/a:redhat:enterprise_linux:rhevm-webadmin-portal, p-cpe:/a:redhat:enterprise_linux:rhevm-websocket-proxy, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 1/21/2014

Vulnerability Publication Date: 1/24/2014

Reference Information

CVE: CVE-2013-6434

BID: 65077

RHSA: 2014:0038