RHEL 6 : Virtualization Manager (RHSA-2013:0888)

Medium Nessus Plugin ID 78960


The remote Red Hat host is missing one or more security updates.


Red Hat Enterprise Virtualization Manager 3.2 is now available.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows. This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.

It was found that permission checks were not performed on the target storage domain when cloning a virtual machine from a snapshot. An attacker could use this flaw to perform a denial of service attack, exhausting free disk space on the target storage domain.

The CVE-2013-2144 issue was discovered by Daniel Erez of Red Hat.

This update also fixes various bugs. Refer to the Technical Notes for information about these changes :

https://access.redhat.com/site/documentation/en-US/ Red_Hat_Enterprise_Virtualization/3.2/html/Technical_Notes/ chap-RHSA-2013-0888.html

All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues.


Update the affected packages.

See Also




Plugin Details

Severity: Medium

ID: 78960

File Name: redhat-RHSA-2013-0888.nasl

Version: $Revision: 1.4 $

Type: local

Agent: unix

Published: 2014/11/08

Modified: 2017/01/05

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rhevm, p-cpe:/a:redhat:enterprise_linux:rhevm-backend, p-cpe:/a:redhat:enterprise_linux:rhevm-config, p-cpe:/a:redhat:enterprise_linux:rhevm-dbscripts, p-cpe:/a:redhat:enterprise_linux:rhevm-genericapi, p-cpe:/a:redhat:enterprise_linux:rhevm-notification-service, p-cpe:/a:redhat:enterprise_linux:rhevm-restapi, p-cpe:/a:redhat:enterprise_linux:rhevm-setup, p-cpe:/a:redhat:enterprise_linux:rhevm-setup-plugin-allinone, p-cpe:/a:redhat:enterprise_linux:rhevm-tools-common, p-cpe:/a:redhat:enterprise_linux:rhevm-userportal, p-cpe:/a:redhat:enterprise_linux:rhevm-webadmin-portal, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/06/10

Reference Information

CVE: CVE-2013-2144

BID: 61028

OSVDB: 94782

RHSA: 2013:0888