modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0547 advisory.

    Red Hat CloudForms is an on-premise hybrid cloud     Infrastructure-as-a-Service (IaaS) product that lets you create and manage     private and public clouds. It provides self-service computing resources to     users in a managed, governed, and secure way. CloudForms System Engine can     be used to configure new systems, subscribe to updates, and maintain     installations in distributed environments.

    It was found that the     /usr/share/katello/script/katello-generate-passphrase utility, which is     run during the installation and configuration process, set world-readable     permissions on the /etc/katello/secure/passphrase file. A local attacker     could use this flaw to obtain the passphrase for Katello, giving them     access to information they would otherwise not have access to.
    (CVE-2012-5561)

    Note: After installing this update, ensure the     /etc/katello/secure/passphrase file is owned by the root user and group     and mode 0750 permissions. Sites should also consider re-creating the     Katello passphrase as this issue exposed it to local users.

    One task the katello-configure utility performs is creating an RPM to be     installed on client machines that need to connect to the Katello server. It     was found that this RPM set world-readable and writable permissions on the     pem file (containing the Certificate Authority certificate) used for     trusting the Katello server. An attacker could use this flaw to perform a     man-in-the-middle attack, allowing them to manage (such as installing and     removing software) Katello client systems. (CVE-2012-6116)

    The CVE-2012-5561 issue was discovered by Aaron Weitekamp of the Red Hat     Cloud Quality Engineering team, and CVE-2012-6116 was discovered by Dominic     Cleal and James Laska of Red Hat.

    This update also fixes the following bugs:

    * The CloudForms System Engine command line tool incorrectly parsed     locales, which caused the following error:

    translation missing: de.activerecord.errors.messages.record_invalid

    This update replaces the controller for setting the locale. The translation     error no longer appears. (BZ#896251)

    * Certain locales did not properly escape certain UI content for new role     creation. This broke the Save button for some locales. This update corrects     the escape behavior for localized UI content. The Save button now works     for new role creation. (BZ#896252)

    * A missing icon stopped users from deleting recent or saved searches. This     update adds the icon and users can now delete recent or saved searches.
    (BZ#896253)

    * A performance issue in the Candlepin 0.7.8 component caused subscription     responsiveness to decrease as the number of systems subscribed to     CloudForms System Engine increases. This erratum updates to Candlepin     0.7.19, which corrects the performance issues. (BZ#896261)

    * CloudForms System Engine would not fetch Extended Update Service (EUS)     entitlements. This blocked the user from seeing and enabling EUS     repositories. This update revises the manifest upload and deletion code,     which also corrects the behavior for fetching entitlements. System Engine     now fetches EUS entitlements. (BZ#896265)

    * Issues with menu widths caused the localized UI to not render certain     menu items. This update corrects the style for the System Engine UI. The     Web UI now renders the menu items correctly. (BZ#903702)

    Refer to the CloudForms 1.1.2 Release Notes for further information about     this release. The Release Notes will be available shortly from     https://access.redhat.com/knowledge/docs/

    To upgrade, follow the upgrade instructions in the CloudForms Installation     Guide, section 4.1. Upgrading CloudForms System Engine:

    https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html

    Users of CloudForms System Engine are advised to upgrade to these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat Subscription Asset Manager 1.2.1, which fixes several security issues, multiple bugs, and adds various enhancements, is now available.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines.

The latest packages for Subscription Asset Manager include a number of security fixes :

When a Subscription Asset Manager instance is created, its configuration script automatically creates an RPM of the internal subscription service CA certificate. However, this RPM incorrectly created the CA certificate with file permissions of 0666. This allowed other users on a client system to modify the CA certificate used to trust the remote subscription server. All administrators are advised to update and deploy the subscription service certificate on all systems which use Subscription Asset Manager as their subscription service. This procedure is described in:
https://access.redhat.com/knowledge/docs/en-US/ Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/ sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Ma nager.html (CVE-2012-6116)

Manifest signature checking was not implemented for early versions of Subscription Asset Manager. This meant that a malicious user could edit a manifest file, insert arbitrary data, and successfully upload the edited manifest file into the Subscription Asset Manager server.
(CVE-2012-6119)

Ruby's documentation generator had a flaw in the way it generated HTML documentation. When a Ruby application exposed its documentation on a network (such as a web page), an attacker could use a specially- crafted URL to open an arbitrary web script or to execute HTML code within the application's user session. (CVE-2013-0256)

A timing attack flaw was found in the way rubygem-rack and ruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid an attacker using forged digital signatures to bypass authentication checks. (CVE-2013-0263)

A flaw in rubygem-json allowed remote attacks by creating different types of malicious objects. For example, it could initiate a denial of service (DoS) attack through resource consumption by using a JSON document to create arbitrary Ruby symbols, which were never garbage collected. It could also be exploited to create internal objects which could allow a SQL injection attack. (CVE-2013-0269)

A flaw in ActiveRecord in Ruby on Rails allowed remote attackers to circumvent attribute protections and to insert their own crafted requests to change protected attribute values. (CVE-2013-0276)

HTML markup was not properly escaped when filling in the username field in the Notifications form of the Subscription Asset Manager UI.
This meant that HTML code used in the value was then applied in the UI page when the entry was viewed. This could have allowed malicious HTML code to be entered. The field value is now validated and any HTML tags are escaped. (CVE-2013-1823)

These updated packages also include bug fixes and enhancements :

* Previously, no SELinux policy for the subscription service was included with the Subscription Asset Manager packages. The candlepin-selinux package is now included with SELinux policies for the subscription server. (BZ#906901)

* When attempting to use the subscription service's CA certificate to validate a manifest during import, the comparison failed. The upstream subscription service which generated the manifest is a different service than the local subscription service; thus, they have different CA certificates. This caused importing a manifest to fail with the error 'archive failed signature'. This has been fixed so that the proper certificate is used for verification. (BZ#918778)

All users of Subscription Asset Manager are recommended to update to the latest packages.

ID	Name	Product	Family	Severity
210166	RHEL 6 : CloudForms System Engine 1.1.2 update (Moderate) (RHSA-2013:0547)	Nessus	Red Hat Local Security Checks	medium
65904	RHEL 6 : Subscription Asset Manager (RHSA-2013:0686)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2012-6116

medium

Tenable Plugins

medium

high