Veracode Vulnerability DatabaseVERACODE:11356Authorization Bypass
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
katello is vulnerable to authorization bypass attacks. The vulnerability exists as modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
References
rhn.redhat.com/errata/RHSA-2013-0547.html
rhn.redhat.com/errata/RHSA-2013-0686.html
secunia.com/advisories/52774
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=906901
bugzilla.redhat.com/show_bug.cgi?id=918778
bugzilla.redhat.com/show_bug.cgi?id=922190
github.com/jsomara/katello/commit/65f1e42b7bda0f3410931c50598540d944d8bf0d
github.com/Katello/katello/commits/master/katello-configure/katello-configure.spec
rhn.redhat.com/errata/RHSA-2013-0686.html
Related
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N