RHEL 6 : rhevm-reports 3.3.3 (RHSA-2014:0558)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated rhevm-reports package that fixes three security issues and
one bug is now available.

The Red Hat Security Response Team has rated this update as having Low
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

The Red Hat Enterprise Virtualization reports package provides a suite
of pre-configured reports and dashboards that enable you to monitor
the system. The reports module is based on JasperReports and
JasperServer, and can also be used to create ad-hoc reports.

It was found that the ovirt-engine-reports setup script logged the
reports database password in plain text to a world-readable file. An
attacker with a local user account on the Red Hat Enterprise
Virtualization Manager server could use this flaw to access, read, and
modify the reports database. (CVE-2014-0199)

Note: Applying the update provided by this advisory does not modify
any existing log files. It is recommended that you search your
existing log files and remove any occurrences of plain text passwords
manually.

It was found that the Red Hat Enterprise Virtualization Manager
reports datasource configuration file (js-jboss7-ds.xml) was
world-readable. An attacker with a local user account on the Red Hat
Enterprise Virtualization Manager server could use this flaw to
access, read, and modify the reports database. (CVE-2014-0200)

It was found that multiple ovirt-engine-reports configuration files
were world-readable. An attacker with a local user account on the Red
Hat Enterprise Virtualization Manager server could use this flaw to
access a variety of potentially sensitive information. (CVE-2014-0201)

These issues were discovered by Red Hat.

This update also fixes the following bug :

* Previously, rhevm-reports-setup failed if the default spacing of the
pg_hba.conf file was manually modified. Now, the command does not
check exact spacing in the file, and setup completes successfully.
(BZ#1085374)

All rhevm-reports users are advised to upgrade to this updated
package, which corrects these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2014-0199.html
https://www.redhat.com/security/data/cve/CVE-2014-0200.html
https://www.redhat.com/security/data/cve/CVE-2014-0201.html
http://rhn.redhat.com/errata/RHSA-2014-0558.html

Solution :

Update the affected rhevm-reports package.

Risk factor :

Low / CVSS Base Score : 2.1
(CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS Temporal Score : 1.8
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 79022 ()

Bugtraq ID: 67682
67684

CVE ID: CVE-2014-0199
CVE-2014-0200
CVE-2014-0201

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now