RHEL 6 : Virtualization Manager (RHSA-2014:0038)
Medium Nessus Plugin ID 78993
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionRed Hat Enterprise Virtualization Manager 3.3 is now available.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows. This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.
A flaw was found in the way Red Hat Enterprise Virtualization Manager relayed SPICE connection information to remote-viewer when a native SPICE client invocation method was used. As a result, remote-viewer attempted an insecure connection first and only switched to a secure connection when requested by the SPICE server. An attacker able to intercept the SPICE connection could use this flaw to conduct man-in-the-middle attacks. (CVE-2013-6434)
Red Hat would like to thank Michael Samuel of Amcom for reporting this issue.
This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.
All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.
SolutionUpdate the affected packages.