Synopsis

Low: sblim-cim-client2 security update

Type/Severity

Security Advisory: Low

Topic

Updated sblim-cim-client2 packages that fix one security issue are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The SBLIM (Standards-Based Linux Instrumentation for Manageability) CIM
(Common Information Model) Client is a class library for Java applications
that provides access to CIM servers using the CIM Operations over HTTP
protocol defined by the DMTF (Distributed Management Task Force) standards.

It was found that the Java HashMap implementation was susceptible to
predictable hash collisions. SBLIM uses HashMap when parsing XML inputs. A
specially-crafted CIM-XML message from a WBEM (Web-Based Enterprise
Management) server could cause a SBLIM client to use an excessive amount of
CPU. Randomization has been added to help avoid collisions. (CVE-2012-2328)

All users of sblim-cim-client2 are advised to upgrade to these updated
packages, which contain a backported patch to resolve this issue.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 819733 - CVE-2012-2328 sblim: hash table collisions CPU usage DoS

CVEs

• CVE-2012-2328

References

• https://access.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 6

SRPM
sblim-cim-client2-2.1.3-2.el6.src.rpm	SHA-256: 6e95f33d30a4c246092d08a700b1fd8396bfbb02c7f952837e0398b749d3ea37
x86_64
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5
i386
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5

Red Hat Enterprise Linux Workstation 6

SRPM
sblim-cim-client2-2.1.3-2.el6.src.rpm	SHA-256: 6e95f33d30a4c246092d08a700b1fd8396bfbb02c7f952837e0398b749d3ea37
x86_64
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5
i386
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
sblim-cim-client2-2.1.3-2.el6.src.rpm	SHA-256: 6e95f33d30a4c246092d08a700b1fd8396bfbb02c7f952837e0398b749d3ea37
s390x
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5

Red Hat Enterprise Linux for Power, big endian 6

SRPM
sblim-cim-client2-2.1.3-2.el6.src.rpm	SHA-256: 6e95f33d30a4c246092d08a700b1fd8396bfbb02c7f952837e0398b749d3ea37
ppc64
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5

Red Hat Enterprise Linux Server from RHUI 6

SRPM
sblim-cim-client2-2.1.3-2.el6.src.rpm	SHA-256: 6e95f33d30a4c246092d08a700b1fd8396bfbb02c7f952837e0398b749d3ea37
x86_64
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5
i386
sblim-cim-client2-2.1.3-2.el6.noarch.rpm	SHA-256: 9dbc6edc08307f346b38c683ae47710c9bb0b68ab6cdab5a2780355c12847ea2
sblim-cim-client2-javadoc-2.1.3-2.el6.noarch.rpm	SHA-256: 68346c5058d065bc824ad8f3d0fbe1b93913b0dbe494491235fc6901ccb12239
sblim-cim-client2-manual-2.1.3-2.el6.noarch.rpm	SHA-256: c0e48eebd5a4d94c4d027c2852e0cfe9a883b3ffe350183b72394020b35600a5