RHEL 6 : Satellite Server (RHSA-2017:1558)

medium Nessus Plugin ID 100983

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Red Hat Satellite 5 for RHEL 6.0 is now available. Updated packages which add various enhancements are now available for Red Hat Satellite 5.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows organizations to utilize the benefits of Red Hat Network (RHN) without having to provide public Internet access to their servers or other client systems.

Security Fix(es) :

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Satellite 5. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users. (CVE-2017-7514)

This issue was discovered by Jan Hutar (Red Hat).

This update introduces Red Hat Satellite 5.8.0. For the full list of new features included in this release, see the Release Notes document at :

https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/5.8/

Note: Red Hat Satellite 5.8 and Red Hat Satellite Proxy 5.8 are available for installation on Red Hat Enterprise Linux Server 6. For full details, including supported architecture combinations, refer to the Red Hat Satellite 5.8 Installation Guide.

All users of Red Hat Satellite are advised to install this newly released version.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 100983

File Name: redhat-RHSA-2017-1558.nasl

Version: 3.12

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 6/22/2017

Updated: 10/24/2019

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:perl-filesys-df, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql-libs, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql-pltcl, p-cpe:/a:redhat:enterprise_linux:satellite-repo, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql-server, p-cpe:/a:redhat:enterprise_linux:spacewalk-setup-postgresql, p-cpe:/a:redhat:enterprise_linux:perl-params-validate, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:spacewalk-dobby, p-cpe:/a:redhat:enterprise_linux:spacewalk-postgresql-server, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-runtime, p-cpe:/a:redhat:enterprise_linux:spacewalk-base-minimal, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql-contrib, p-cpe:/a:redhat:enterprise_linux:perl-filesys-df-debuginfo, p-cpe:/a:redhat:enterprise_linux:perl-params-validate-debuginfo, p-cpe:/a:redhat:enterprise_linux:rh-postgresql95-postgresql-debuginfo

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 6/20/2017

Vulnerability Publication Date: 7/30/2018

Reference Information

CVE: CVE-2017-7514

RHSA: 2017:1558

Detections

Analytics