RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

According to its self-reported version number, the remote Junos Space version is prior to 13.3R1.8. It is, therefore, affected by multiple vulnerabilities in bundled third party software components :

  - Multiple vulnerabilities in RedHat JBoss application     server. (CVE-2010-0738, CVE-2010-1428, CVE-2010-1429,     CVE-2011-5245, CVE-2012-0818)

  - Multiple vulnerabilities in Oracle Java SE JDK.
    (CVE-2012-3143, CVE-2013-1537, CVE-2013-1557,     CVE-2013-2422)

  - Multiple vulnerabilities in Oracle MySQL server.
    (CVE-2013-1502, CVE-2013-1511, CVE-2013-1532,     CVE-2013-1544, CVE-2013-2375, CVE-2013-2376,     CVE-2013-2389, CVE-2013-2391, CVE-2013-2392,     CVE-2013-3783, CVE-2013-3793, CVE-2013-3794,     CVE-2013-3801, CVE-2013-3802, CVE-2013-3804,     CVE-2013-3805, CVE-2013-3808, CVE-2013-3809,     CVE-2013-3812, CVE-2013-3839)

  - Multiple vulnerabilities in Apache HTTP Server.
    (CVE-2013-1862, CVE-2013-1896)

  - Known hard-coded MySQL credentials. (CVE-2014-3413)

Updated Red Hat Storage Console packages that fix one security issue, various bugs, and add enhancements are now available for Red Hat Storage Server 2.1.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Storage Console (RHS-C) is a powerful and simple web based Graphical User Interface for managing a Red Hat Storage 2.1 environment. This feature is provided as a Technology Preview, and is currently not supported under Red Hat Storage subscription services.
Refer to the following for more information about Technology Previews:
https://access.redhat.com/support/offerings/techpreview/

It was found that RESTEasy was vulnerable to XML External Entity (XXE) attacks. If a remote attacker who is able to access the Red Hat Storage Console REST API submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM (Document Object Model) Document and JAXB (Java Architecture for XML Binding) input.
(CVE-2012-0818)

This update also fixes the following bugs :

* A new server could not be added to a cluster if the required packages were not installed on the server. Now, the administrator can add a server to a cluster which will automatically install the required packages, if missing. (BZ#850431)

* Previously, the rhs-log-collector tool did not collect GlusterFS related logs. (BZ#855271)

* Previously, it was not possible for rhsc-setup to complete successfully on systems that have SELinux in disabled mode.
(BZ#841342)

* The 'Add Brick' button in the 'Add Bricks' pop up is now placed next to the 'Brick Directory' field for a better UI experience. (BZ#863929)

* The UUID of the volume was not visible. Now, a new field is added to the 'Summary' sub-tab of the 'Volumes' tab to display the UUIDs.
(BZ#887806)

* The web console was not accessible after a server reboot. The setup mechanism has been modified to ensure the web console is accessible after a server reboot. (BZ#838284)

This update also adds the following enhancements :

* Previously, to import an existing storage cluster into the Red Hat Storage Console the hosts were added one by one. Now, a new feature has been added that allows users to import an existing storage cluster. The new Cluster Creation window has an option to import an existing storage cluster. If IP_Address or the hostname and password of one of the hosts of the cluster is entered, a list containing all the hosts of the cluster is displayed and the same can be added to the Console. The volumes which are part of the cluster also get imported.
(BZ#850438)

* The command line was required to enable a volume to use CIFS. Now, you can enable or disable the export of a volume with the new 'CIFS' checkbox in the 'Create Volume' window. (BZ#850452)

* The new Red Hat Support plug-in for Red Hat Storage is a Technology Preview feature that offers seamless, integrated access to the Red Hat subscription services from the Red Hat Customer Portal. Subscribers who install this plug-in can access these features :

* Create, manage, and update the Red Hat support cases.

* Conveniently access exclusive Red Hat knowledge and solutions.

* Search error codes, messages, etc. and view related knowledge from the Red Hat Customer Portal. (BZ#999245)

* A new 'Event ID' column is added to the 'Events' table in the 'Advanced View' of 'Events' tab which allows users to see the ID of each event in the 'Events' tab. (BZ#889942)

* A new feature is added to manage and monitor the hooks on the Console. It also reports changes in the hooks and checks for new hook scripts by polling at regular intervals. (BZ#850483)

* A new 'Optimize for Virt Store' option is added to optimize a volume to use it as a virt store. The system sets the 'virt' group option on the volume and also the following two volume options :

* storage.owner-uid=36

* storage.owner-gid=36

This option is available during volume creation and also for existing volumes. (BZ#891493, BZ#891491)

All users of Red Hat Storage Server 2.1 are advised to upgrade to these updated packages.

Updated rhevm packages that fix one security issue and various bugs are now available.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual machines running Red Hat Enterprise Linux and Microsoft Windows. These packages also include the Red Hat Enterprise Virtualization Manager REST (Representational State Transfer) API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager.

It was found that RESTEasy was vulnerable to XML External Entity (XXE) attacks. If a remote attacker who is able to access the Red Hat Enterprise Virtualization Manager REST API submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM (Document Object Model) Document and JAXB (Java Architecture for XML Binding) input. (CVE-2012-0818)

This update also fixes the following bugs :

* Previously the REST API was ignoring the 'Accept' header. This made it impossible to retrieve detailed information about specific sub-collections, including hosts and disks. The REST API has been updated and now processes the 'Accept' header as originally intended.
(BZ#771369)

* The 'start_time' Virtual Machine property was previously always set.
This meant that even Virtual Machines that were stopped, had a value for 'start_time'. An update has been made to ensure that the 'start_time' property is only set when the Virtual Machine has been started, and is running. (BZ#772975)

* The 'rhevm-setup' script previously only ran successfully on systems with their locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The script has since been updated to also run successfully in additional locales, including 'ja_JP.UTF-8'.
(BZ#784860)

* The REST API did not previously validate that all required parameters were provided when enabling power management. The response code returned would also incorrectly indicate the operation had succeeded where mandatory parameters were not supplied. An update has been made to ensure that the power management parameters are validated correctly. (BZ#785744)

* Previously no warning or error was issued when the amount of free disk space on a host was low. When no free disk space remained on the host it would become non-responsive with no prior warning. An update has been made to report a warning in the audit log when a host's free disk space is less than 1000 MB, and an error when a host's free disk space is less than 500 MB. (BZ#786132)

* When importing Virtual Machines no notification was provided if the MAC address of the network interface card clashed with that of an existing Virtual Machine. Now when this occurs a message is printed to the audit log, highlighting the need for manual intervention.
(BZ#795416)

* Previously it was not possible to set more, or less, than one value for SpiceSecureChannels using the rhevm-config tool. This meant it was not possible to encrypt all SPICE channels. The rhevm-config tool has been updated and it is now possible to encrypt all SPICE channels, by adding them to the SpiceSecureChannels configuration key. (BZ#784012)

All Red Hat Enterprise Virtualization users are advised to upgrade to these updated packages, which address this vulnerability and fix these bugs. Refer to the Solution section for information about installing this update.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1059 advisory.

  - RESTEasy: XML eXternal Entity (XXE) flaw (CVE-2011-5245, CVE-2012-0818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
80195	Juniper Junos Space < 13.3R1.8 Multiple Vulnerabilities (JSA10627)	Nessus	Junos Local Security Checks	critical
79289	RHEL 6 : Storage Server (RHSA-2013:1263)	Nessus	Red Hat Local Security Checks	medium
79284	RHEL 6 : rhevm (RHSA-2012:0421)	Nessus	Red Hat Local Security Checks	medium
64046	RHEL 5 / 6 : resteasy (RHSA-2012:1059)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2012-0818

medium

Tenable Plugins

critical

medium

medium

medium