Skip to navigation

Security Advisory Critical: Red Hat CloudForms Management Engine security update

Advisory: RHSA-2013:1206-3
Type: Security Advisory
Severity: Critical
Issued on: 2013-09-04
Last updated on: 2013-09-04
Affected Products:
CVEs (cve.mitre.org): CVE-2013-2068

Details

The RHSA-2013:1157 update for Red Hat CloudForms Management Engine included
an additional fix that was not documented in the erratum.

The Red Hat Security Response Team has rated this update as having
critical security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Red Hat CloudForms Management Engine provides the insight, control, and
automation needed to address the challenges of managing virtual
environments.

Multiple directory traversal flaws were found in Red Hat CloudForms
Management Engine. A remote, unauthenticated attacker could use these flaws
to upload arbitrary code, and have that code executed with root privileges
on Red Hat CloudForms Management Engine. (CVE-2013-2068)

This issue was discovered by Ramon de C Valle of the Red Hat Product
Security Team.

Note: This issue was already addressed in the fixpack released as part of
RHSA-2013:1157, however it was not documented and therefore the erratum was
incorrectly rated as having important security impact. No new packages are
available in this erratum; please install the fixpack as noted in
RHSA-2013:1157.

Refer to the Solution section of this erratum for installation
instructions.


Solution

The update is provided in a fixpack, available from:

https://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=17971

To install the fixpack, follow the instructions in the following Red Hat
Knowledge Base article:

https://access.redhat.com/site/articles/450563

Updated packages


Bugs fixed (see bugzilla for more information)

960422 - CVE-2013-2068 CFME 2.0 multiple zip file upload path traversal vulnerabilities


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/