Security Advisory Critical: Red Hat CloudForms Management Engine security update

Advisory: RHSA-2013:1206-3
Type: Security Advisory
Severity: Critical
Issued on: 2013-09-04
Last updated on: 2013-09-04
Affected Products:
CVEs ( CVE-2013-2068


The RHSA-2013:1157 update for Red Hat CloudForms Management Engine included
an additional fix that was not documented in the erratum.

The Red Hat Security Response Team has rated this update as having
critical security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Red Hat CloudForms Management Engine provides the insight, control, and
automation needed to address the challenges of managing virtual

Multiple directory traversal flaws were found in Red Hat CloudForms
Management Engine. A remote, unauthenticated attacker could use these flaws
to upload arbitrary code, and have that code executed with root privileges
on Red Hat CloudForms Management Engine. (CVE-2013-2068)

This issue was discovered by Ramon de C Valle of the Red Hat Product
Security Team.

Note: This issue was already addressed in the fixpack released as part of
RHSA-2013:1157, however it was not documented and therefore the erratum was
incorrectly rated as having important security impact. No new packages are
available in this erratum; please install the fixpack as noted in

Refer to the Solution section of this erratum for installation


The update is provided in a fixpack, available from:

To install the fixpack, follow the instructions in the following Red Hat
Knowledge Base article:

Updated packages

Bugs fixed (see bugzilla for more information)

960422 - CVE-2013-2068 CFME 2.0 multiple zip file upload path traversal vulnerabilities


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:

The Red Hat security contact is More contact details at