RHEL 6 : Satellite Server (RHSA-2015:0033)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Red Hat Satellite 5.7.0 is now available. Updated packages that fix
two security issues, several bugs, and add various enhancements are
now available for Red Hat Satellite 5.

Red Hat Product Security has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Red Hat Satellite provides a solution to organizations requiring
absolute control over and privacy of the maintenance and package
deployment of their servers. It allows organizations to utilize the
benefits of Red Hat Network (RHN) without having to provide public
Internet access to their servers or other client systems.

This update introduces Red Hat Satellite 5.7.0. For the full list of
new features included in this release, see the Release Notes document
at :

https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/5.7/

Note: Red Hat Satellite 5.7 and Red Hat Satellite Proxy 5.7 are
available for installation on Red Hat Enterprise Linux Server 6. For
full details, including supported architecture combinations, refer to
the Red Hat Satellite 5.7 Installation Guide.

This update fixes the following security issues :

Multiple stored cross-site scripting (XSS) flaw were found in the
handling of XML data passed to Satellite via the REST API. By sending
a specially crafted request to Satellite, a remote, authenticated
attacker could embed HTML content into the stored data, allowing them
to inject malicious content into the web page that is used to view
that data. (CVE-2014-7811)

A stored cross-site scripting (XSS) flaw was found in the System
Groups field. By sending a specially crafted request to Satellite, a
remote, authenticated attacker could embed HTML content into the
stored data, allowing them to inject malicious content into the web
page that is used to view that data. (CVE-2014-7812)

Red Hat would like to thank Mickael Gallier for reporting these
issues.

All users of Red Hat Satellite are advised to install this newly
released version.

See also :

https://www.redhat.com/security/data/cve/CVE-2014-7811.html
https://www.redhat.com/security/data/cve/CVE-2014-7812.html
https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/5.7/
http://rhn.redhat.com/errata/RHSA-2015-0033.html

Solution :

Update the affected packages.

Risk factor :

Low / CVSS Base Score : 3.5
(CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS Temporal Score : 3.0
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 80505 ()

Bugtraq ID: 74825
74829

CVE ID: CVE-2014-7811
CVE-2014-7812

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now