Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:13832
HistoryMay 02, 2019 - 4:41 a.m.

Privilege Escalation

2019-05-0204:41:52
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

JSON

Red Hat CloudForms is an on-premise hybrid cloud Infrastructure-as-a-Service (IaaS) product that lets you create and manage private and public clouds. This update fixes bugs in and adds enhancements to the System Engine packages, and upgrades the system to CloudForms 1.1. This update also fixes the following security issues: It was discovered that Katello did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to download consumer certificates or change settings of other users’ systems if they knew the target system’s UUID. (CVE-2012-5603) It was discovered that Pulp logged administrative passwords to a world readable log file. A local attacker could use this flaw to control systems deployed and managed by CloudForms. (CVE-2012-3538) It was discovered that the Pulp configuration file pulp.conf was installed as world readable. A local attacker could use this flaw to view the administrative password, allowing them to control systems deployed and managed by CloudForms. (CVE-2012-4574) It was discovered that grinder used insecure permissions for its cache directory. A local attacker could use this flaw to access or modify files in the cache. (CVE-2012-5605) The CVE-2012-5603 issue was discovered by Lukas Zapletal of Red Hat; CVE-2012-3538 was discovered by James Laska of Red Hat; CVE-2012-4574 was discovered by Kurt Seifried of Red Hat; and CVE-2012-5605 was discovered by James Labocki of Red Hat. After upgrading to these new packages, follow the instructions in the “4.1. Upgrading CloudForms System Engine” section of the CloudForms 1.1 Installation Guide: https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html To view the full list of changes in this update, view the CloudForms Technical Notes: https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Technical_Notes/index.html Users are advised to upgrade to these updated CloudForms System Engine packages, which resolve these issues and add these enhancements.

References

Related

redhat 2
nessus 2
veracode 3
prion 4
cve 4
owncloud 2
redhat
redhat
(RHSA-2012:1543) Important: CloudForms System Engine 1.1 update
2012-12-04 00:00:00
(RHSA-2013:0544) Important: Subscription Asset Manager 1.2 update
2013-02-21 00:00:00
nessus
nessus
RHEL 5 / 6 : CloudForms System Engine 1.1 update (Important) (RHSA-2012:1543)
2024-04-27 00:00:00
RHEL 6 : Subscription Asset Manager (RHSA-2013:0544)
2013-03-10 00:00:00
veracode
veracode
Information Disclosure
2019-05-02 04:41:51
Information Disclosure
2019-05-02 04:41:52
Information Disclosure
2019-01-15 08:51:08
prion
prion
Design/Logic Flaw
2013-01-04 22:55:00
Code injection
2013-01-04 22:55:00
Default credentials
2013-01-04 22:55:00
cve
cve
CVE-2012-5603
2013-01-04 22:55:00
CVE-2012-4574
2013-01-04 22:55:00
CVE-2012-3538
2013-01-04 22:55:00
owncloud
owncloud
Server: Multiple XSS vulnerabilities
2012-08-24 11:42:22
Multiple XSS vulnerabilities - ownCloud
2012-08-24 09:24:57

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

JSON
Related for VERACODE:13832
redhat2nessus2veracode3prion4cve4owncloud2