Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0128 advisory.

    [0.12.2-64.0.2.el5]
    - Remove conga-enterprise.patch

    [0.12.2-64.0.1.el5]
    - Added conga-enterprise.patch
    - Added conga-enterprise-Carthage.patch to support OEL5
    - Replaced redhat logo image in conga-0.12.2.tar.gz and Data.fs

    [0.12.2-64]
    - Improvements for bz786372 (Better protect luci's authentication cookie)
    - Improvements for bz607179 (Improper handling of session timeouts)

    [0.12.2-60]
    - Improvements for bz832185 (Luci cannot configure the 'identity_file' attribute for fence_ilo_mp)
    - Improvements for bz822633 (Add luci support for nfsrestart)

    [0.12.2-59]
    - Fix bz835649 (luci uninstall will leave /var/lib/luci/var/pts and /usr/lib*/luci/zope/var/pts behind)

    [0.12.2-58]
    - Fix bz832183 (Luci is missing configuration of ssl for fence_ilo)

    [0.12.2-57]
    - Fix bz835649 (luci uninstall will leave /var/lib/luci/var/pts and /usr/lib*/luci/zope/var/pts behind)

    [0.12.2-56]
    - Fix bz842865 (Conga unable to find/install packages due to line breaks in yum output)

    [0.12.2-55]
    - Add support for IBM iPDU fencing configuration (Resolves bz741986)

    [0.12.2-54]
    - Fix bz839732 (Conga Add a Service Screen is Missing Option for Restart-Disable Recovery Policy)

    [0.12.2-53]
    - Fix bz786372 (Better protect luci's authentication cookie)
    - Fix bz607179 (Improper handling of session timeouts)

    [0.12.2-52]
    - Fix bz822633 (Add luci support for nfsrestart)
    - Fix bz832181 (fence_apc_snmp is missing from luci)
    - Fix bz832183 (Luci is missing configuration of ssl for fence_ilo)
    - Fix bz832185 (Luci cannot configure the 'identity_file' attribute for fence_ilo_mp)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0128 advisory.

  - conga: insecure handling of luci web interface sessions (CVE-2012-3359)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
(CVE-2012-3359)

This update also fixes the following bugs :

  - Prior to this update, luci did not allow the     fence_apc_snmp agent to be configured. As a consequence,     users could not configure or view an existing     configuration for fence_apc_snmp. This update adds a new     screen that allows fence_apc_snmp to be configured.

  - Prior to this update, luci did not allow the SSL     operation of the fence_ilo fence agent to be enabled or     disabled. As a consequence, users could not configure or     view an existing configuration for the 'ssl' attribute     for fence_ilo. This update adds a checkbox to show     whether the SSL operation is enabled and allows users to     edit that attribute.

  - Prior to this update, luci did not allow the     'identity_file' attribute of the fence_ilo_mp fence     agent to be viewed or edited. As a consequence, users     could not configure or view an existing configuration     for the 'identity_file' attribute of the fence_ilo_mp     fence agent. This update adds a text input box to show     the current state of the 'identity_file' attribute of     fence_ilo_mp and allows users to edit that attribute.

  - Prior to this update, redundant files and directories     remained on the file system at /var/lib/luci/var/pts and     /usr/lib{,64}/luci/zope/var/pts when the luci package     was uninstalled. This update removes these files and     directories when the luci package is uninstalled.

  - Prior to this update, the 'restart-disable' recovery     policy was not displayed in the recovery policy list     from which users could select when they configure a     recovery policy for a failover domain. As a consequence,     the 'restart-disable' recovery policy could not be set     with the luci GUI. This update adds the     'restart-disable' recovery option to the recovery policy     pulldown list.

  - Prior to this update, line breaks that were not     anticipated in the 'yum list' output could cause package     upgrade and/or installation to fail when creating     clusters or adding nodes to existing clusters. As a     consequence, creating clusters and adding cluster nodes     to existing clusters could fail. This update modifies     the ricci daemon to be able to correctly handle line     breaks in the 'yum list' output.

In addition, this update adds the following enhancements :

  - This update adds support for configuring the Intel iPDU     fence agent to the luci package.

  - This update adds support for viewing and changing the     state of the new 'nfsrestart' attribute to the FS and     Cluster FS resource agent configuration screens.

After installing this update, the luci and ricci services will be restarted automatically.

Updated conga packages that fix one security issue, multiple bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Conga project is a management system for remote workstations. It consists of luci, which is a secure web-based front end, and ricci, which is a secure daemon that dispatches incoming messages to underlying management modules.

It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
(CVE-2012-3359)

Red Hat would like to thank George Hedfors of Cybercom Sweden East AB for reporting this issue.

This update also fixes the following bugs :

* Prior to this update, luci did not allow the fence_apc_snmp agent to be configured. As a consequence, users could not configure or view an existing configuration for fence_apc_snmp. This update adds a new screen that allows fence_apc_snmp to be configured. (BZ#832181)

* Prior to this update, luci did not allow the SSL operation of the fence_ilo fence agent to be enabled or disabled. As a consequence, users could not configure or view an existing configuration for the 'ssl' attribute for fence_ilo. This update adds a checkbox to show whether the SSL operation is enabled and allows users to edit that attribute. (BZ#832183)

* Prior to this update, luci did not allow the 'identity_file' attribute of the fence_ilo_mp fence agent to be viewed or edited. As a consequence, users could not configure or view an existing configuration for the 'identity_file' attribute of the fence_ilo_mp fence agent. This update adds a text input box to show the current state of the 'identity_file' attribute of fence_ilo_mp and allows users to edit that attribute. (BZ#832185)

* Prior to this update, redundant files and directories remained on the file system at /var/lib/luci/var/pts and /usr/lib{,64}/luci/zope/var/pts when the luci package was uninstalled.
This update removes these files and directories when the luci package is uninstalled. (BZ#835649)

* Prior to this update, the 'restart-disable' recovery policy was not displayed in the recovery policy list from which users could select when they configure a recovery policy for a failover domain. As a consequence, the 'restart-disable' recovery policy could not be set with the luci GUI. This update adds the 'restart-disable' recovery option to the recovery policy pulldown list. (BZ#839732)

* Prior to this update, line breaks that were not anticipated in the 'yum list' output could cause package upgrade and/or installation to fail when creating clusters or adding nodes to existing clusters. As a consequence, creating clusters and adding cluster nodes to existing clusters could fail. This update modifies the ricci daemon to be able to correctly handle line breaks in the 'yum list' output. (BZ#842865)

In addition, this update adds the following enhancements :

* This update adds support for configuring the Intel iPDU fence agent to the luci package. (BZ#741986)

* This update adds support for viewing and changing the state of the new 'nfsrestart' attribute to the FS and Cluster FS resource agent configuration screens. (BZ#822633)

All users of conga are advised to upgrade to these updated packages, which resolve these issues and add these enhancements. After installing this update, the luci and ricci services will be restarted automatically.

ID	Name	Product	Family	Severity
68699	Oracle Linux 5 : conga (ELSA-2013-0128)	Nessus	Oracle Linux Local Security Checks	critical
64074	RHEL 5 : conga (RHSA-2013:0128)	Nessus	Red Hat Local Security Checks	critical
63592	Scientific Linux Security Update : conga on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	low
63573	CentOS 5 : conga (CESA-2013:0128)	Nessus	CentOS Local Security Checks	low

Detections

Analytics

CVE-2012-3359

critical

Tenable Plugins

critical

critical

low

low