RHEL 6 : rhevm-dwh 3.3.3 (RHSA-2014:0559)

low Nessus Plugin ID 79023

Synopsis

The remote Red Hat host is missing a security update.

Description

An updated rhevm-dwh package that fixes one security issue and two bugs is now available.

The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Red Hat Enterprise Virtualization Manager data warehouse package provides the Extract-Transform-Load (ETL) process and database scripts to create a historic database API. It also provides SQL BI reports creation for management and monitoring.

It was found that the ovirt-engine-dwh setup script logged the history database password in plain text to a world-readable file. An attacker with a local user account on the Red Hat Enterprise Virtualization Manager server could use this flaw to access, read, and modify the reports database. (CVE-2014-0202)

Note: Applying the update provided by this advisory does not modify any existing log files. It is recommended that you search your existing log files and remove any occurrences of plain text passwords manually.

This issue was discovered by Red Hat.

This update also fixes the following bugs :

* Previously, the read-only user and custom users for the data warehouse database would lose access to views in the database when the database was upgraded. This was caused by the views being regenerated when the database was upgraded and the permissions for those views not being applied to the newly generated views. Now, user permissions are retained when the database is upgraded. (BZ#1078129)

* Previously, the ovirt-engine-dwh-setup command would fail under certain conditions if the pg_hba.conf file had been manually edited prior to running that command. This was caused by the setup process checking the exact number of spaces in between values on the line corresponding to 'local'. Now, the logic for checking the values in that line has been revised so that the setup process can correctly read all values regardless of the number of spaces. (BZ#1084760)

All rhevm-dwh users are advised to upgrade to this updated package, which corrects these issues.

Solution

Update the affected rhevm-dwh package.

See Also

https://access.redhat.com/errata/RHSA-2014:0559

https://access.redhat.com/security/cve/cve-2014-0202

Plugin Details

Severity: Low

ID: 79023

File Name: redhat-RHSA-2014-0559.nasl

Version: 1.14

Type: local

Agent: unix

Published: 11/8/2014

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rhevm-dwh, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 5/27/2014

Vulnerability Publication Date: 5/30/2014

Reference Information

CVE: CVE-2014-0202

BID: 67690

RHSA: 2014:0559