Skip to navigation

Security Advisory Moderate: rhncfg security, bug fix, and enhancement update

Advisory: RHSA-2012:1369-2
Type: Security Advisory
Severity: Moderate
Issued on: 2012-10-15
Last updated on: 2012-10-15
Affected Products: Red Hat Network Tools
CVEs (cve.mitre.org): CVE-2012-2679

Details

Updated rhncfg packages that fix one security issue, two bugs, and add one
enhancement are now available for Red Hat Network Tools for Red Hat
Enterprise Linux 5 and 6; Red Hat Enterprise Linux 5.3 Long Life; and Red
Hat Enterprise Linux 5.6, 6.0, 6.1, and 6.2 Extended Update Support.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Red Hat Network Tools provide programs and libraries that allow your system
to use provisioning, monitoring, and configuration management capabilities
provided by Red Hat Network and Red Hat Network Satellite.

It was discovered that the Red Hat Network (RHN) Configuration Client
(rhncfg-client) tool set world-readable permissions on the
"/var/log/rhncfg-actions" file, used to store the output of different
rhncfg-client actions (such as diffing and verifying files). This could
possibly allow a local attacker to obtain sensitive information they would
otherwise not have access to. (CVE-2012-2679)

Note: With this update, rhncfg-client cannot create diffs of files that
are not already world-readable, and "/var/log/rhncfg-actions" can only be
read and written to by the root user.

This issue was discovered by Paul Wouters of Red Hat.

This update also fixes the following bugs:

* When the user attempted to use the "rhncfg-client get" command to
download a backup of deployed configuration files and these configuration
files contained a broken symbolic link, the command failed with an error.
This update ensures that "rhncfg-client get" no longer fails in this
scenario. (BZ#836445)

* The SYNOPSIS section of the rhn-actions-control(8) manual page has been
updated to include the "--report" command line option as expected.
(BZ#820517)

As well, this update adds the following enhancement:

* The rhncfg-manager utility now supports a new command line option,
"--selinux-context". This option can be used to upload files and
directories without setting the Security-Enhanced Linux (SELinux) context.
(BZ#770575)

All users of Red Hat Network Tools are advised to upgrade to these updated
packages, which correct these issues and add this enhancement.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Network Tools

SRPMS:
rhncfg-5.10.27-8.el5sat.src.rpm
File outdated by:  RHEA-2013:1391
    MD5: 894a948566177f21c9e32b084cbf4246
SHA-256: dd61e373fbb12bda86b0041a2292583158c14d8066f900fd1a0f33eb729526e7
rhncfg-5.10.27-8.el6sat.src.rpm
File outdated by:  RHEA-2013:1391
    MD5: 6aa3f07c0b50086f5a7b1a4ca8de431f
SHA-256: a7aa0924561da53c9003ddf96b2959e9bfc03c72f794b2b5f85376ee453c414d
 
IA-32:
rhncfg-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 5af81027eeba70c905e2a0c4a54f5176
SHA-256: 404f811e051327037441651e34d58edeae433c042f5337a17ea4d65a16500d8c
rhncfg-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: a1f93fa2b3b4535c1d35eac1cde719f9
SHA-256: 5b494a2467cab5017890dd695d4cdefd4405d6a63c6250ad3e2261a2c50105c5
rhncfg-actions-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bfffe5f6c2c68c41899e32565d5815b2
SHA-256: 267f918a344b44bc9f20f0d0fb1406b8986d25762450bebd3fa8dee54a019af8
rhncfg-actions-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 023c5dfe3e7a6ef42fe52f10587470fd
SHA-256: 1e85101f6dae7558e7f71ee1b76313e296d71ff9da8e27859d1b7b43f7cfcf2e
rhncfg-client-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bc7a2715f7ce8f2160d2b4d2373a182c
SHA-256: 6398a8172b434592c3c4455d8720db12a04591bbd145b7f434eba63468218956
rhncfg-client-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 51f8ca326fc922cbad3f9e9a6c00a33c
SHA-256: 99f5104ec202d747e46faf1c296e15cdf386c5414c4ac84b23c6635b2ee7ba08
rhncfg-management-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 8fd9b5060b359999c474f63ce7eb06dc
SHA-256: 019025ef70469423fcc3b02543a1e5fcff3bf2d291ecf22a6bab01c95ba279a0
rhncfg-management-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 103c56b5db851f450370d625e885c8ea
SHA-256: 0153fa30781a26066cca6714ef524130ab95e1e95bf60397ccfd330fba5500d1
 
IA-64:
rhncfg-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 5af81027eeba70c905e2a0c4a54f5176
SHA-256: 404f811e051327037441651e34d58edeae433c042f5337a17ea4d65a16500d8c
rhncfg-actions-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bfffe5f6c2c68c41899e32565d5815b2
SHA-256: 267f918a344b44bc9f20f0d0fb1406b8986d25762450bebd3fa8dee54a019af8
rhncfg-client-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bc7a2715f7ce8f2160d2b4d2373a182c
SHA-256: 6398a8172b434592c3c4455d8720db12a04591bbd145b7f434eba63468218956
rhncfg-management-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 8fd9b5060b359999c474f63ce7eb06dc
SHA-256: 019025ef70469423fcc3b02543a1e5fcff3bf2d291ecf22a6bab01c95ba279a0
 
PPC:
rhncfg-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: 5af81027eeba70c905e2a0c4a54f5176
SHA-256: 404f811e051327037441651e34d58edeae433c042f5337a17ea4d65a16500d8c
rhncfg-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: a1f93fa2b3b4535c1d35eac1cde719f9
SHA-256: 5b494a2467cab5017890dd695d4cdefd4405d6a63c6250ad3e2261a2c50105c5
rhncfg-actions-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: bfffe5f6c2c68c41899e32565d5815b2
SHA-256: 267f918a344b44bc9f20f0d0fb1406b8986d25762450bebd3fa8dee54a019af8
rhncfg-actions-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 023c5dfe3e7a6ef42fe52f10587470fd
SHA-256: 1e85101f6dae7558e7f71ee1b76313e296d71ff9da8e27859d1b7b43f7cfcf2e
rhncfg-client-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: bc7a2715f7ce8f2160d2b4d2373a182c
SHA-256: 6398a8172b434592c3c4455d8720db12a04591bbd145b7f434eba63468218956
rhncfg-client-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 51f8ca326fc922cbad3f9e9a6c00a33c
SHA-256: 99f5104ec202d747e46faf1c296e15cdf386c5414c4ac84b23c6635b2ee7ba08
rhncfg-management-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: 8fd9b5060b359999c474f63ce7eb06dc
SHA-256: 019025ef70469423fcc3b02543a1e5fcff3bf2d291ecf22a6bab01c95ba279a0
rhncfg-management-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 103c56b5db851f450370d625e885c8ea
SHA-256: 0153fa30781a26066cca6714ef524130ab95e1e95bf60397ccfd330fba5500d1
 
s390x:
rhncfg-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: 5af81027eeba70c905e2a0c4a54f5176
SHA-256: 404f811e051327037441651e34d58edeae433c042f5337a17ea4d65a16500d8c
rhncfg-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: a1f93fa2b3b4535c1d35eac1cde719f9
SHA-256: 5b494a2467cab5017890dd695d4cdefd4405d6a63c6250ad3e2261a2c50105c5
rhncfg-actions-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: bfffe5f6c2c68c41899e32565d5815b2
SHA-256: 267f918a344b44bc9f20f0d0fb1406b8986d25762450bebd3fa8dee54a019af8
rhncfg-actions-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 023c5dfe3e7a6ef42fe52f10587470fd
SHA-256: 1e85101f6dae7558e7f71ee1b76313e296d71ff9da8e27859d1b7b43f7cfcf2e
rhncfg-client-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: bc7a2715f7ce8f2160d2b4d2373a182c
SHA-256: 6398a8172b434592c3c4455d8720db12a04591bbd145b7f434eba63468218956
rhncfg-client-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 51f8ca326fc922cbad3f9e9a6c00a33c
SHA-256: 99f5104ec202d747e46faf1c296e15cdf386c5414c4ac84b23c6635b2ee7ba08
rhncfg-management-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHEA-2013:1391
    MD5: 8fd9b5060b359999c474f63ce7eb06dc
SHA-256: 019025ef70469423fcc3b02543a1e5fcff3bf2d291ecf22a6bab01c95ba279a0
rhncfg-management-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 103c56b5db851f450370d625e885c8ea
SHA-256: 0153fa30781a26066cca6714ef524130ab95e1e95bf60397ccfd330fba5500d1
 
x86_64:
rhncfg-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 5af81027eeba70c905e2a0c4a54f5176
SHA-256: 404f811e051327037441651e34d58edeae433c042f5337a17ea4d65a16500d8c
rhncfg-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: a1f93fa2b3b4535c1d35eac1cde719f9
SHA-256: 5b494a2467cab5017890dd695d4cdefd4405d6a63c6250ad3e2261a2c50105c5
rhncfg-actions-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bfffe5f6c2c68c41899e32565d5815b2
SHA-256: 267f918a344b44bc9f20f0d0fb1406b8986d25762450bebd3fa8dee54a019af8
rhncfg-actions-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 023c5dfe3e7a6ef42fe52f10587470fd
SHA-256: 1e85101f6dae7558e7f71ee1b76313e296d71ff9da8e27859d1b7b43f7cfcf2e
rhncfg-client-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: bc7a2715f7ce8f2160d2b4d2373a182c
SHA-256: 6398a8172b434592c3c4455d8720db12a04591bbd145b7f434eba63468218956
rhncfg-client-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 51f8ca326fc922cbad3f9e9a6c00a33c
SHA-256: 99f5104ec202d747e46faf1c296e15cdf386c5414c4ac84b23c6635b2ee7ba08
rhncfg-management-5.10.27-8.el5sat.noarch.rpm
File outdated by:  RHBA-2013:0969
    MD5: 8fd9b5060b359999c474f63ce7eb06dc
SHA-256: 019025ef70469423fcc3b02543a1e5fcff3bf2d291ecf22a6bab01c95ba279a0
rhncfg-management-5.10.27-8.el6sat.noarch.rpm
File outdated by:  RHBA-2012:1552
    MD5: 103c56b5db851f450370d625e885c8ea
SHA-256: 0153fa30781a26066cca6714ef524130ab95e1e95bf60397ccfd330fba5500d1
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

820517 - Missing option in man page for rhn-actions-control.
825275 - CVE-2012-2679 rhncfg: Insecure permissions used for /var/log/rhncfg-actions file


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/