The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1508 advisory.

    VDSM is a management module that serves as a Red Hat Enterprise     Virtualization Manager agent on Red Hat Enterprise Virtualization     Hypervisor or Red Hat Enterprise Linux 6.3 hosts.

    A flaw was found in the way Red Hat Enterprise Linux hosts were added to     the Red Hat Enterprise Virtualization environment. The Python scripts     needed to configure the host for Red Hat Enterprise Virtualization were     stored in the /tmp/ directory and could be pre-created by an attacker. A     local, unprivileged user on the host to be added to the Red Hat Enterprise     Virtualization environment could use this flaw to escalate their     privileges. This update provides the VDSM part of the fix. The     RHSA-2012:1506 Red Hat Enterprise Virtualization Manager update must also     be installed to completely fix this issue. (CVE-2012-0860)

    A flaw was found in the way Red Hat Enterprise Linux and Red Hat Enterprise     Virtualization Hypervisor hosts were added to the Red Hat Enterprise     Virtualization environment. The Python scripts needed to configure the host     for Red Hat Enterprise Virtualization were downloaded in an insecure way,     that is, without properly validating SSL certificates during HTTPS     connections. An attacker on the local network could use this flaw to     conduct a man-in-the-middle attack, potentially gaining root access to the     host being added to the Red Hat Enterprise Virtualization environment. This     update provides the VDSM part of the fix. The RHSA-2012:1506 Red Hat     Enterprise Virtualization Manager update must also be installed to     completely fix this issue. (CVE-2012-0861)

    The CVE-2012-0860 and CVE-2012-0861 issues were discovered by Red Hat.

    In addition to resolving the above security issues these updated VDSM     packages fix various bugs, and add various enhancements.

    Documentation for these bug fixes and enhancements is available in the     Technical Notes:

    https://access.redhat.com/knowledge/docs/en-     US/Red_Hat_Enterprise_Virtualization/3.1/html/Technical_Notes/index.html

    All users who require VDSM are advised to install these updated packages     which resolve these security issues, fix these bugs, and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : rhev-3.1.0 vdsm (RHSA-2012:1508)

high Nessus Plugin ID 78941

Version 1.13

Version 1.12

Version 1.13 Jun 3, 2024, 4:41 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202406031641
Version 1.12 Apr 25, 2024, 2:46 AM Plugin metadata CVE (set "CVE" coverage to "CVE-2012-0860,CVE-2012-0861") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (set to "CVE-2012-0861") CVSSv3 score source (set to "CVE-2012-0860") Detection (updated detection logic) Reference Plugin Feed: 202404250246