RHEL 6 : Virtualization Manager (RHSA-2014:0038)

Medium Nessus Plugin ID 78993


The remote Red Hat host is missing one or more security updates.


Red Hat Enterprise Virtualization Manager 3.3 is now available.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows. This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.

A flaw was found in the way Red Hat Enterprise Virtualization Manager relayed SPICE connection information to remote-viewer when a native SPICE client invocation method was used. As a result, remote-viewer attempted an insecure connection first and only switched to a secure connection when requested by the SPICE server. An attacker able to intercept the SPICE connection could use this flaw to conduct man-in-the-middle attacks. (CVE-2013-6434)

Red Hat would like to thank Michael Samuel of Amcom for reporting this issue.

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.


Update the affected packages.

See Also




Plugin Details

Severity: Medium

ID: 78993

File Name: redhat-RHSA-2014-0038.nasl

Version: $Revision: 1.4 $

Type: local

Agent: unix

Published: 2014/11/08

Modified: 2017/01/06

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rhevm, p-cpe:/a:redhat:enterprise_linux:rhevm-backend, p-cpe:/a:redhat:enterprise_linux:rhevm-dbscripts, p-cpe:/a:redhat:enterprise_linux:rhevm-lib, p-cpe:/a:redhat:enterprise_linux:rhevm-restapi, p-cpe:/a:redhat:enterprise_linux:rhevm-setup, p-cpe:/a:redhat:enterprise_linux:rhevm-setup-plugin-allinone, p-cpe:/a:redhat:enterprise_linux:rhevm-tools, p-cpe:/a:redhat:enterprise_linux:rhevm-userportal, p-cpe:/a:redhat:enterprise_linux:rhevm-webadmin-portal, p-cpe:/a:redhat:enterprise_linux:rhevm-websocket-proxy, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/01/21

Reference Information

CVE: CVE-2013-6434

BID: 65077

OSVDB: 102425

RHSA: 2014:0038