Security Advisory Moderate: rhevm security and bug fix update

Advisory: RHSA-2012:0421-1
Type: Security Advisory
Severity: Moderate
Issued on: 2012-03-26
Last updated on: 2012-03-26
Affected Products: Red Hat Enterprise Virtualization 3
CVEs (cve.mitre.org): CVE-2011-5245
CVE-2012-0818

Details

Updated rhevm packages that fix one security issue and various bugs are now
available.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Red Hat Enterprise Virtualization Manager is a visual tool for centrally
managing collections of virtual machines running Red Hat Enterprise Linux
and Microsoft Windows. These packages also include the Red Hat Enterprise
Virtualization Manager REST (Representational State Transfer) API, a set of
scriptable commands that give administrators the ability to perform queries
and operations on Red Hat Enterprise Virtualization Manager.

It was found that RESTEasy was vulnerable to XML External Entity (XXE)
attacks. If a remote attacker who is able to access the Red Hat Enterprise
Virtualization Manager REST API submitted a request containing an external
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing
the attacker to read files accessible to the user running the application
server. This flaw affected DOM (Document Object Model) Document and JAXB
(Java Architecture for XML Binding) input. (CVE-2012-0818)

This update also fixes the following bugs:

* Previously the REST API was ignoring the "Accept" header. This made it
impossible to retrieve detailed information about specific sub-collections,
including hosts and disks. The REST API has been updated and now processes
the "Accept" header as originally intended. (BZ#771369)

* The "start_time" Virtual Machine property was previously always set. This
meant that even Virtual Machines that were stopped, had a value for
"start_time". An update has been made to ensure that the "start_time"
property is only set when the Virtual Machine has been started, and is
running. (BZ#772975)

* The 'rhevm-setup' script previously only ran successfully on systems with
their locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The
script has since been updated to also run successfully in additional
locales, including 'ja_JP.UTF-8'. (BZ#784860)

* The REST API did not previously validate that all required parameters
were provided when enabling power management. The response code returned
would also incorrectly indicate the operation had succeeded where
mandatory parameters were not supplied. An update has been made to ensure
that the power management parameters are validated correctly. (BZ#785744)

* Previously no warning or error was issued when the amount of free disk
space on a host was low. When no free disk space remained on the host it
would become non-responsive with no prior warning. An update has been made
to report a warning in the audit log when a host's free disk space is less
than 1000 MB, and an error when a host's free disk space is less than 500
MB. (BZ#786132)

* When importing Virtual Machines no notification was provided if the MAC
address of the network interface card clashed with that of an existing
Virtual Machine. Now when this occurs a message is printed to the audit
log, highlighting the need for manual intervention. (BZ#795416)

* Previously it was not possible to set more, or less, than one value for
SpiceSecureChannels using the rhevm-config tool. This meant it was not
possible to encrypt all SPICE channels. The rhevm-config tool has been
updated and it is now possible to encrypt all SPICE channels, by adding
them to the SpiceSecureChannels configuration key. (BZ#784012)

All Red Hat Enterprise Virtualization users are advised to upgrade to these
updated packages, which address this vulnerability and fix these bugs.
Refer to the Solution section for information about installing this update.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Follow the upgrade
procedure in the Red Hat Enterprise Virtualization
Installation Guide to install these updated packages:

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html

Updated packages

Red Hat Enterprise Virtualization 3

SRPMS:
rhevm-3.0.3_0001-3.el6.src.rpm
File outdated by:  RHBA-2012:1496
    MD5: 8eef75dab2c5d1dbfaf76b0c0e0f4c20
SHA-256: 80d89f868146049d11c1cbfb92e65dc39e3d9dda73f33f699c8b7c5357539e32
 
x86_64:
rhevm-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 149f4d446dd6f4123c1e2cf3be65df5b
SHA-256: a8b1cb19f4bd2d673d0133e4330cdfb6c80edd40c13c110e6d388f711460cce3
rhevm-backend-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: dccdf2abe06f3a3b45d72940c0e2f9b4
SHA-256: f43e4f11c237000ff7186f63605685a4e10d95d09d4e8a16423ff1c94b2f3103
rhevm-config-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 3a2d8cb61615b5d77a6d4487360a0341
SHA-256: 0ea2b3ebc6d8bced94b1c16765fc34417d18ebcf45cb43edde9564d52d2776ca
rhevm-dbscripts-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 5c44583f21b9ac229898de132f474c26
SHA-256: 3300a3a000308d4155de45df0cd7e5b2872898c671d8b6275f974bead3888673
rhevm-debuginfo-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 40c0b4611e393dcc0f5ded61d8cd426b
SHA-256: 3953b8d4ac30ad3e54076f2f380fb731ea337da49a9281a87615b8bc847a37a5
rhevm-genericapi-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 7e835a322cb344f737e76eb6a8badcc0
SHA-256: 89b4c8e8c2c8908a32d7e09ab0c8296e9f105d1d5e7fff683a6c8f77b715fcc5
rhevm-iso-uploader-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 131e7aadd998bc141fbbac1b714597c9
SHA-256: ed12ecd5c485437a824e5216b7f0cff20306ca8afdd0628f9eeda681e92f4baf
rhevm-jboss-deps-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 17bba33eff3e6ab3d41d0af114528ce0
SHA-256: 67e858d3f443deab1b02f03c54420eda604b0ce9f24d06e6cd13cef46809bc54
rhevm-log-collector-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 5dff095ba4a949029c59dd48ba634721
SHA-256: 553a3bef9bb9e282deb5e18597f7420ccd0a84ad40a1c684c46b4d6dd547f43c
rhevm-notification-service-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 18623752184022dded3ee94dbd4bb185
SHA-256: 2a6d79458f33f3ff142f5a3a2d50671a59538acd6e2238f92d698bb9a5a839bd
rhevm-restapi-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 42fa218cacbb77f26a29a0ad6989a234
SHA-256: ba9b1164305d32d692709aa357753b4bbaef1ba13ed5b1641943b948aac48f39
rhevm-setup-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 0f7cd8b29757920982a318ca923d57f0
SHA-256: 1c6f642d6f33659a45e5421e673a304ee03d75f55c0259fd067229d7c84dbbfd
rhevm-tools-common-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: 8a77919a5542d89383f8d591405cb324
SHA-256: a555493cbf0ff021dbd8b310e32f095c1fed256fd9f81c276536fcfb486680cc
rhevm-userportal-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: a721bc4958315db5f0872e20eb5796ef
SHA-256: 2fe7a610383e03a3d77a0c42dba40c723e0d2b13faee0ab8d5ea00d245e18b50
rhevm-webadmin-portal-3.0.3_0001-3.el6.x86_64.rpm
File outdated by:  RHBA-2012:1496
    MD5: de8a01509b5ffa1da08634db9ff1a74b
SHA-256: db245d775d0fd901682c7d780eb424c52a0328e567d129d3bbaa938c627dbc31
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

785631 - CVE-2012-0818 RESTEasy: XML eXternal Entity (XXE) flaw


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/