RHEL 6 : Virtualization Manager (RHSA-2013:0888)
Medium Nessus Plugin ID 78960
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionRed Hat Enterprise Virtualization Manager 3.2 is now available.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows. This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.
It was found that permission checks were not performed on the target storage domain when cloning a virtual machine from a snapshot. An attacker could use this flaw to perform a denial of service attack, exhausting free disk space on the target storage domain.
The CVE-2013-2144 issue was discovered by Daniel Erez of Red Hat.
This update also fixes various bugs. Refer to the Technical Notes for information about these changes :
https://access.redhat.com/site/documentation/en-US/ Red_Hat_Enterprise_Virtualization/3.2/html/Technical_Notes/ chap-RHSA-2013-0888.html
All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues.
SolutionUpdate the affected packages.