Synopsis

Moderate: Red Hat Network Satellite server security update

Type/Severity

Security Advisory: Moderate

Topic

Updated packages that fix one security issue are now available for
Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat Network (RHN) Satellite provides a solution to organizations
requiring absolute control over and privacy of the maintenance and package
deployment of their servers. It allows organizations to utilize the
benefits of the Red Hat Network without having to provide public Internet
access to their servers or other client systems.

A cross-site scripting (XSS) flaw was found in the RHN Satellite web
interface. An authenticated RHN Satellite user could use this flaw to
perform a cross-site scripting attack against other authenticated users who
are using the RHN Satellite web interface. (CVE-2011-4346)

Red Hat would like to thank William Hoffmann for reporting this issue.

Users of Red Hat Network Satellite 5.4.1 are advised to upgrade to these
updated packages, which contain a patch to correct this issue. For this
update to take effect, Red Hat Network Satellite must be restarted. Refer
to the Solution section for details.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Run the following command to restart the Red Hat Network Satellite
server:

# rhn-satellite restart

Affected Products

• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6 x86_64
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6 s390x
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 x86_64
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 s390x
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 i386

Fixes

• BZ - 742050 - EMBARGOED CVE-2011-4346 satellite: XSS flaw in custom system information key handling

CVEs

• CVE-2011-4346

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6

SRPM
spacewalk-web-1.2.7-21.el6sat.src.rpm	SHA-256: 9cbc572bdd8cccab19cefde7d8140cbf684c171d925b0595b7029bc64eb32ef8
x86_64
spacewalk-base-1.2.7-21.el6sat.noarch.rpm	SHA-256: 514e808aebf1ceff6c0269699deb96991dc5297bff6b87dc110c256ba0492961
spacewalk-base-minimal-1.2.7-21.el6sat.noarch.rpm	SHA-256: 9efda237cf650bca01b4dd6f13bc6aca2b452233787f66556fb7b347ecd6fdc8
spacewalk-dobby-1.2.7-21.el6sat.noarch.rpm	SHA-256: 6d5f26cd268b244e2f75ada162ebfd41fbf7b2b3f049db4494e7ca55e8e9ad6e
spacewalk-grail-1.2.7-21.el6sat.noarch.rpm	SHA-256: e95a78b37ffd1bb26b746cc94e23c82c2d6e87ec0668183a0ac3f5e3ee36ef7f
spacewalk-html-1.2.7-21.el6sat.noarch.rpm	SHA-256: 44d647698c296ab461af5e1c97cefbdf8ce092791b7ad8715e8e512512d00d7a
spacewalk-pxt-1.2.7-21.el6sat.noarch.rpm	SHA-256: eeeb684191bee44392242012464a1aa3aa1e707adf98ad433cc205c72aa4d236
spacewalk-sniglets-1.2.7-21.el6sat.noarch.rpm	SHA-256: ca5be420c78e1e874896509189b127bf0c91adaf8eeb61944c603b666dfee323
s390x
spacewalk-base-1.2.7-21.el6sat.noarch.rpm	SHA-256: 514e808aebf1ceff6c0269699deb96991dc5297bff6b87dc110c256ba0492961
spacewalk-base-minimal-1.2.7-21.el6sat.noarch.rpm	SHA-256: 9efda237cf650bca01b4dd6f13bc6aca2b452233787f66556fb7b347ecd6fdc8
spacewalk-dobby-1.2.7-21.el6sat.noarch.rpm	SHA-256: 6d5f26cd268b244e2f75ada162ebfd41fbf7b2b3f049db4494e7ca55e8e9ad6e
spacewalk-grail-1.2.7-21.el6sat.noarch.rpm	SHA-256: e95a78b37ffd1bb26b746cc94e23c82c2d6e87ec0668183a0ac3f5e3ee36ef7f
spacewalk-html-1.2.7-21.el6sat.noarch.rpm	SHA-256: 44d647698c296ab461af5e1c97cefbdf8ce092791b7ad8715e8e512512d00d7a
spacewalk-pxt-1.2.7-21.el6sat.noarch.rpm	SHA-256: eeeb684191bee44392242012464a1aa3aa1e707adf98ad433cc205c72aa4d236
spacewalk-sniglets-1.2.7-21.el6sat.noarch.rpm	SHA-256: ca5be420c78e1e874896509189b127bf0c91adaf8eeb61944c603b666dfee323

Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5

SRPM
spacewalk-web-1.2.7-21.el5sat.src.rpm	SHA-256: e67d839a0a71c4aea90d9508709491d73fa258b3de8302ca8a39ebfa6c4af026
x86_64
spacewalk-base-1.2.7-21.el5sat.noarch.rpm	SHA-256: a6873014b7efe68439527ae21062418f27cac8160193dc1d95ef897fb7d5df0b
spacewalk-base-minimal-1.2.7-21.el5sat.noarch.rpm	SHA-256: 3c57eb1c862ec6ffb3abccf9c87945fa64c5a9d92fa47a6ef926f71cb13b1017
spacewalk-dobby-1.2.7-21.el5sat.noarch.rpm	SHA-256: e9d43dcdcbd51165f97ff97214d2bdb95bbf24c5f0dcaf8365157a5633a4a971
spacewalk-grail-1.2.7-21.el5sat.noarch.rpm	SHA-256: 01fc5a1c86ca4c927c1d38b9d7830d657ec7358dd4479d2d86636cd5310661bb
spacewalk-html-1.2.7-21.el5sat.noarch.rpm	SHA-256: d0e6d46640f2bea1a740b1f0afd23a458e4e69e368d1cc887533c985594ffaba
spacewalk-pxt-1.2.7-21.el5sat.noarch.rpm	SHA-256: 7d2e1bfb8c7cab026a5fa22d160c469f7ff2abbd412f61bd4feb8ebfef1f8588
spacewalk-sniglets-1.2.7-21.el5sat.noarch.rpm	SHA-256: 789f9741bba866752404f2b7cde64df80f4dc34b449bba7fad5da0e35f698976
s390x
spacewalk-base-1.2.7-21.el5sat.noarch.rpm	SHA-256: a6873014b7efe68439527ae21062418f27cac8160193dc1d95ef897fb7d5df0b
spacewalk-base-minimal-1.2.7-21.el5sat.noarch.rpm	SHA-256: 3c57eb1c862ec6ffb3abccf9c87945fa64c5a9d92fa47a6ef926f71cb13b1017
spacewalk-dobby-1.2.7-21.el5sat.noarch.rpm	SHA-256: e9d43dcdcbd51165f97ff97214d2bdb95bbf24c5f0dcaf8365157a5633a4a971
spacewalk-grail-1.2.7-21.el5sat.noarch.rpm	SHA-256: 01fc5a1c86ca4c927c1d38b9d7830d657ec7358dd4479d2d86636cd5310661bb
spacewalk-html-1.2.7-21.el5sat.noarch.rpm	SHA-256: d0e6d46640f2bea1a740b1f0afd23a458e4e69e368d1cc887533c985594ffaba
spacewalk-pxt-1.2.7-21.el5sat.noarch.rpm	SHA-256: 7d2e1bfb8c7cab026a5fa22d160c469f7ff2abbd412f61bd4feb8ebfef1f8588
spacewalk-sniglets-1.2.7-21.el5sat.noarch.rpm	SHA-256: 789f9741bba866752404f2b7cde64df80f4dc34b449bba7fad5da0e35f698976
i386
spacewalk-base-1.2.7-21.el5sat.noarch.rpm	SHA-256: a6873014b7efe68439527ae21062418f27cac8160193dc1d95ef897fb7d5df0b
spacewalk-base-minimal-1.2.7-21.el5sat.noarch.rpm	SHA-256: 3c57eb1c862ec6ffb3abccf9c87945fa64c5a9d92fa47a6ef926f71cb13b1017
spacewalk-dobby-1.2.7-21.el5sat.noarch.rpm	SHA-256: e9d43dcdcbd51165f97ff97214d2bdb95bbf24c5f0dcaf8365157a5633a4a971
spacewalk-grail-1.2.7-21.el5sat.noarch.rpm	SHA-256: 01fc5a1c86ca4c927c1d38b9d7830d657ec7358dd4479d2d86636cd5310661bb
spacewalk-html-1.2.7-21.el5sat.noarch.rpm	SHA-256: d0e6d46640f2bea1a740b1f0afd23a458e4e69e368d1cc887533c985594ffaba
spacewalk-pxt-1.2.7-21.el5sat.noarch.rpm	SHA-256: 7d2e1bfb8c7cab026a5fa22d160c469f7ff2abbd412f61bd4feb8ebfef1f8588
spacewalk-sniglets-1.2.7-21.el5sat.noarch.rpm	SHA-256: 789f9741bba866752404f2b7cde64df80f4dc34b449bba7fad5da0e35f698976