Synopsis

Moderate: cobbler security update

Type/Severity

Security Advisory: Moderate

Topic

An updated cobbler package that fixes one security issue is now available
for Red Hat Network Satellite 5.4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Cobbler is a network install server. Cobbler supports PXE, virtualized
installs, and re-installing existing Linux machines.

A command injection flaw was found in Cobbler's power management XML-RPC
method. A remote, authenticated user who is permitted to perform Cobbler
configuration changes via the Cobbler XML-RPC API, could use this flaw to
execute arbitrary code with root privileges on the Red Hat Network
Satellite server. (CVE-2012-2395)

Note: Red Hat Network Satellite uses a special user account to configure
Cobbler. By default, only this account is permitted to perform Cobbler
configuration changes, and the credentials for the account are only
accessible to the Satellite host's administrator. As such, this issue only
affected environments where the administrator allowed other users to make
Cobbler configuration changes.

Users of Red Hat Network Satellite 5.4 are advised to upgrade to this
updated cobbler package, which contains a backported patch to correct this
issue. Red Hat Network Satellite must be restarted
("/usr/sbin/rhn-satellite restart") for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6 x86_64
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6 s390x
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 x86_64
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 s390x
• Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5 i386

Fixes

• BZ - 824460 - CVE-2012-2395 cobbler: command injection flaw in the power management XML-RPC API

CVEs

• CVE-2012-2395

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Satellite with Embedded Oracle 5.4 for RHEL 6

SRPM
cobbler-2.0.7-14.6.el6sat.src.rpm	SHA-256: a8683234f75a9c6215ba4aedde7c55af7bd7fb1e63935061c7c8e370f2af07d1
x86_64
cobbler-2.0.7-14.6.el6sat.noarch.rpm	SHA-256: 1d80958268a91e0958d0cf554251aeef89593f388c06ff29f68ce27fe6f3bd0d
s390x
cobbler-2.0.7-14.6.el6sat.noarch.rpm	SHA-256: 1d80958268a91e0958d0cf554251aeef89593f388c06ff29f68ce27fe6f3bd0d

Red Hat Satellite with Embedded Oracle 5.4 for RHEL 5

SRPM
cobbler-2.0.7-14.6.el5sat.src.rpm	SHA-256: fb48a5a995037cb875cc01e471968935fb21ee15fecb46b648fe583b92d84739
x86_64
cobbler-2.0.7-14.6.el5sat.noarch.rpm	SHA-256: fd88e520d3212e2edab3116fc477b8c30a976c1c4c8df24770870ffc11c81316
s390x
cobbler-2.0.7-14.6.el5sat.noarch.rpm	SHA-256: fd88e520d3212e2edab3116fc477b8c30a976c1c4c8df24770870ffc11c81316
i386
cobbler-2.0.7-14.6.el5sat.noarch.rpm	SHA-256: fd88e520d3212e2edab3116fc477b8c30a976c1c4c8df24770870ffc11c81316