Synopsis

Moderate: Red Hat Network Satellite Server security update

Type/Severity

Security Advisory: Moderate

Topic

Updated packages that fix two security issues are now available for Red Hat
Network Satellite Server 5.4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Red Hat Network Satellite Server (RHN Satellite Server) is a system
management tool for Linux-based infrastructures. It allows for the
provisioning, remote management and monitoring of multiple Linux
deployments with a single, centralized tool.

A session fixation flaw was found in the way RHN Satellite Server handled
session cookies. An RHN Satellite Server user able to pre-set the session
cookie in a victim's browser to a valid value could use this flaw to hijack
the victim's session after the next log in. (CVE-2011-0717)

A flaw was found in the way RHN Satellite Server managed user
authentication. A time delay was not inserted after each failed log in,
which could allow a remote attacker to conduct a password guessing attack
efficiently. (CVE-2011-0718)

Red Hat would like to thank Thomas Biege of the SuSE Security Team for
reporting these issues.

Users of RHN Satellite Server 5.4 are advised to upgrade to these updated
packages, which contain backported patches to correct these issues. RHN
Satellite Server must be restarted ("rhn-satellite restart") for this
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 x86_64
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 s390x
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 i386

Fixes

• BZ - 672159 - CVE-2011-0717 Satellite, Spacewalk: Session fixation flaw
• BZ - 672163 - CVE-2011-0718 Satellite, Spacewalk: Prone to brute force password guessing attacks

CVEs

• CVE-2011-0717
• CVE-2011-0718

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5

SRPM
spacewalk-backend-1.2.13-26.2.el5sat.src.rpm	SHA-256: 3084d786c50eaa6790a27da18d8de4df08e6f3a47badfedd8b972e28abc0873b
spacewalk-java-1.2.39-35.1.el5sat.src.rpm	SHA-256: bd14d27fb40d28ace72199f54c6d2d710369f53ef5630512c012ac860fe5eac7
x86_64
spacewalk-backend-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3ab1a74ac4f6671366c7ecb8cf5bc333dcd69086e8f2c68bf9f8ec882c04e8dd
spacewalk-backend-app-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3cb57dabae042610374fa8c8ba52967658104ae96194e6f8f52e86643acd2e96
spacewalk-backend-applet-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4efbc6614e30fe8fc2e54e2963f6d2fc532ce390d5099454d2f7309aa67e4980
spacewalk-backend-config-files-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 614ef8dd32a8aba86e1833d408cc13568afe72203a1089539270b0971fcd7703
spacewalk-backend-config-files-common-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7cfaa7fe97a7a072ed1eb1e1efea2f65f8adfa39b5018754ca5646f8c39679d9
spacewalk-backend-config-files-tool-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e463109bc6d610b189c19c2ff6bba42d84f3bc70ccd9027a9184b7661eb36858
spacewalk-backend-iss-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 041da8c238dbb5ee308553ce40e979d02ade09f8cd7e7e8b94eab975e8f07bba
spacewalk-backend-iss-export-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7b0d12fce286b926a201ed89e3f22beca219e939e5f67300254b1750ed7f6aef
spacewalk-backend-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: d4fd6bcacc387249780d27e13cc75888ba3968b5f3c98f487456822615fafd57
spacewalk-backend-package-push-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: ced0b41935cc37f4f804e5dd33be9f00caa3ef32cdb370f250d9b726526a69c4
spacewalk-backend-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 120b0d937857049888fe9a81b86c68ddf3104dc5dd9bc3be5aedc756c5d196d9
spacewalk-backend-sql-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 23cf3727ba392d4072bc6688e8e6d4e69c8670df43462b857fb64bb1b43fa8ca
spacewalk-backend-sql-oracle-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: b8865d0ae4d7696c65411831f4e9d6122359866da8197752cc0a128c6f459412
spacewalk-backend-tools-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 891f97d38620e5e28add94c49b614404d07c0a65a3ce3858a5d3c9790c2eb62f
spacewalk-backend-upload-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4bbb7916935199a3c1de1dd2c94760cd0114cf75da64156f95d2d083d7a92686
spacewalk-backend-xml-export-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: c80dfe6ddcc96b6eda04ffab7698fd730a8ec6962d653e01fb08c4253a50b2eb
spacewalk-backend-xmlrpc-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e1be2da40254b08bd45a0cd766d19b59cfc710240f65d5c8ed4fca9df73fcfec
spacewalk-backend-xp-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 605a34dd4d692ba396bb118efc7ab455c535efc7d0e37f19237425df3676f3ca
spacewalk-java-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: fa03d039ef59ae4cf8c06b3a6c5a68b579e6e020abf7c16bdbf3421f827b159e
spacewalk-java-config-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: c06732f5d0011661d2a159ef4e83318308c3523ab9b07bba03ca48c6b4de6b12
spacewalk-java-lib-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 96f0fa539e969369dddf9a779f795285eb9b4e030ed493f340af6e3913e913e4
spacewalk-java-oracle-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 1c3076e0fca58cc7f52e32ca3e0d8fb5b3172a60de6ac9be92873b336f1f4c9d
spacewalk-taskomatic-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 068295e1895673d29daa2d7fcb98d69d58b6bbaeb72973244206275dea0c3282
s390x
spacewalk-backend-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3ab1a74ac4f6671366c7ecb8cf5bc333dcd69086e8f2c68bf9f8ec882c04e8dd
spacewalk-backend-app-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3cb57dabae042610374fa8c8ba52967658104ae96194e6f8f52e86643acd2e96
spacewalk-backend-applet-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4efbc6614e30fe8fc2e54e2963f6d2fc532ce390d5099454d2f7309aa67e4980
spacewalk-backend-config-files-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 614ef8dd32a8aba86e1833d408cc13568afe72203a1089539270b0971fcd7703
spacewalk-backend-config-files-common-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7cfaa7fe97a7a072ed1eb1e1efea2f65f8adfa39b5018754ca5646f8c39679d9
spacewalk-backend-config-files-tool-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e463109bc6d610b189c19c2ff6bba42d84f3bc70ccd9027a9184b7661eb36858
spacewalk-backend-iss-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 041da8c238dbb5ee308553ce40e979d02ade09f8cd7e7e8b94eab975e8f07bba
spacewalk-backend-iss-export-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7b0d12fce286b926a201ed89e3f22beca219e939e5f67300254b1750ed7f6aef
spacewalk-backend-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: d4fd6bcacc387249780d27e13cc75888ba3968b5f3c98f487456822615fafd57
spacewalk-backend-package-push-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: ced0b41935cc37f4f804e5dd33be9f00caa3ef32cdb370f250d9b726526a69c4
spacewalk-backend-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 120b0d937857049888fe9a81b86c68ddf3104dc5dd9bc3be5aedc756c5d196d9
spacewalk-backend-sql-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 23cf3727ba392d4072bc6688e8e6d4e69c8670df43462b857fb64bb1b43fa8ca
spacewalk-backend-sql-oracle-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: b8865d0ae4d7696c65411831f4e9d6122359866da8197752cc0a128c6f459412
spacewalk-backend-tools-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 891f97d38620e5e28add94c49b614404d07c0a65a3ce3858a5d3c9790c2eb62f
spacewalk-backend-upload-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4bbb7916935199a3c1de1dd2c94760cd0114cf75da64156f95d2d083d7a92686
spacewalk-backend-xml-export-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: c80dfe6ddcc96b6eda04ffab7698fd730a8ec6962d653e01fb08c4253a50b2eb
spacewalk-backend-xmlrpc-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e1be2da40254b08bd45a0cd766d19b59cfc710240f65d5c8ed4fca9df73fcfec
spacewalk-backend-xp-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 605a34dd4d692ba396bb118efc7ab455c535efc7d0e37f19237425df3676f3ca
spacewalk-java-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: fa03d039ef59ae4cf8c06b3a6c5a68b579e6e020abf7c16bdbf3421f827b159e
spacewalk-java-config-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: c06732f5d0011661d2a159ef4e83318308c3523ab9b07bba03ca48c6b4de6b12
spacewalk-java-lib-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 96f0fa539e969369dddf9a779f795285eb9b4e030ed493f340af6e3913e913e4
spacewalk-java-oracle-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 1c3076e0fca58cc7f52e32ca3e0d8fb5b3172a60de6ac9be92873b336f1f4c9d
spacewalk-taskomatic-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 068295e1895673d29daa2d7fcb98d69d58b6bbaeb72973244206275dea0c3282
i386
spacewalk-backend-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3ab1a74ac4f6671366c7ecb8cf5bc333dcd69086e8f2c68bf9f8ec882c04e8dd
spacewalk-backend-app-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 3cb57dabae042610374fa8c8ba52967658104ae96194e6f8f52e86643acd2e96
spacewalk-backend-applet-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4efbc6614e30fe8fc2e54e2963f6d2fc532ce390d5099454d2f7309aa67e4980
spacewalk-backend-config-files-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 614ef8dd32a8aba86e1833d408cc13568afe72203a1089539270b0971fcd7703
spacewalk-backend-config-files-common-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7cfaa7fe97a7a072ed1eb1e1efea2f65f8adfa39b5018754ca5646f8c39679d9
spacewalk-backend-config-files-tool-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e463109bc6d610b189c19c2ff6bba42d84f3bc70ccd9027a9184b7661eb36858
spacewalk-backend-iss-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 041da8c238dbb5ee308553ce40e979d02ade09f8cd7e7e8b94eab975e8f07bba
spacewalk-backend-iss-export-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 7b0d12fce286b926a201ed89e3f22beca219e939e5f67300254b1750ed7f6aef
spacewalk-backend-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: d4fd6bcacc387249780d27e13cc75888ba3968b5f3c98f487456822615fafd57
spacewalk-backend-package-push-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: ced0b41935cc37f4f804e5dd33be9f00caa3ef32cdb370f250d9b726526a69c4
spacewalk-backend-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 120b0d937857049888fe9a81b86c68ddf3104dc5dd9bc3be5aedc756c5d196d9
spacewalk-backend-sql-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 23cf3727ba392d4072bc6688e8e6d4e69c8670df43462b857fb64bb1b43fa8ca
spacewalk-backend-sql-oracle-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: b8865d0ae4d7696c65411831f4e9d6122359866da8197752cc0a128c6f459412
spacewalk-backend-tools-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 891f97d38620e5e28add94c49b614404d07c0a65a3ce3858a5d3c9790c2eb62f
spacewalk-backend-upload-server-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 4bbb7916935199a3c1de1dd2c94760cd0114cf75da64156f95d2d083d7a92686
spacewalk-backend-xml-export-libs-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: c80dfe6ddcc96b6eda04ffab7698fd730a8ec6962d653e01fb08c4253a50b2eb
spacewalk-backend-xmlrpc-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: e1be2da40254b08bd45a0cd766d19b59cfc710240f65d5c8ed4fca9df73fcfec
spacewalk-backend-xp-1.2.13-26.2.el5sat.noarch.rpm	SHA-256: 605a34dd4d692ba396bb118efc7ab455c535efc7d0e37f19237425df3676f3ca
spacewalk-java-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: fa03d039ef59ae4cf8c06b3a6c5a68b579e6e020abf7c16bdbf3421f827b159e
spacewalk-java-config-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: c06732f5d0011661d2a159ef4e83318308c3523ab9b07bba03ca48c6b4de6b12
spacewalk-java-lib-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 96f0fa539e969369dddf9a779f795285eb9b4e030ed493f340af6e3913e913e4
spacewalk-java-oracle-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 1c3076e0fca58cc7f52e32ca3e0d8fb5b3172a60de6ac9be92873b336f1f4c9d
spacewalk-taskomatic-1.2.39-35.1.el5sat.noarch.rpm	SHA-256: 068295e1895673d29daa2d7fcb98d69d58b6bbaeb72973244206275dea0c3282