- Issued:
- 2013-09-04
- Updated:
- 2013-09-04
RHSA-2013:1206 - Security Advisory
Synopsis
Critical: Red Hat CloudForms Management Engine security update
Type/Severity
Security Advisory: Critical
Topic
The RHSA-2013:1157 update for Red Hat CloudForms Management Engine included
an additional fix that was not documented in the erratum.
The Red Hat Security Response Team has rated this update as having
critical security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
Description
Red Hat CloudForms Management Engine provides the insight, control, and
automation needed to address the challenges of managing virtual
environments.
Multiple directory traversal flaws were found in Red Hat CloudForms
Management Engine. A remote, unauthenticated attacker could use these flaws
to upload arbitrary code, and have that code executed with root privileges
on Red Hat CloudForms Management Engine. (CVE-2013-2068)
This issue was discovered by Ramon de C Valle of the Red Hat Product
Security Team.
Note: This issue was already addressed in the fixpack released as part of
RHSA-2013:1157, however it was not documented and therefore the erratum was
incorrectly rated as having important security impact. No new packages are
available in this erratum; please install the fixpack as noted in
RHSA-2013:1157.
Refer to the Solution section of this erratum for installation
instructions.
Solution
The update is provided in a fixpack, available from:
https://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=17971
To install the fixpack, follow the instructions in the following Red Hat
Knowledge Base article:
Affected Products
- Red Hat CloudForms 3.0 x86_64
Fixes
- BZ - 960422 - CVE-2013-2068 CFME 2.0 multiple zip file upload path traversal vulnerabilities
CVEs
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
