Red Hat Product Errata RHSA-2014:1037 - Security Advisory
Issued:
2014-08-13
Updated:
2014-08-13

RHSA-2014:1037 - Security Advisory

Synopsis

Moderate: cfme security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated cfme packages that fix one security issue and several bugs are now
available for Red Hat CloudForms 3.0.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control, and
automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails, a
model-view-controller (MVC) framework for web application development.
Action Pack implements the controller and the view components.

It was found that the get and log methods of the AgentController wrote log
messages without sanitizing user input. A remote attacker could use this
flaw to insert arbitrary content into the log files written to by
AgentController. (CVE-2014-0136)

This issue was discovered by Jan Rusnacko of Red Hat Product Security.

This update also fixes several bugs. Documentation for these changes will
be available shortly from the Technical Notes document linked to in the
References section.

All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated
packages, which correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

  • Red Hat CloudForms 3.0 x86_64

Fixes

  • BZ - 1076669 - CVE-2014-0136 CFME: AgentController get/log application log forging

Red Hat CloudForms 3.0

SRPM
x86_64
cfme-5.2.5.3-2.el6cf.x86_64.rpm SHA-256: 0a74aff084428fd04dd81b00c958d6a6445406636a2e804e6ca66cc587537b9c
cfme-appliance-5.2.5.3-2.el6cf.x86_64.rpm SHA-256: 46e860f9026d242cd362fc3ef1f890e1d50a8866c43a22e017a8dc9fb9f586be
cfme-debuginfo-5.2.5.3-2.el6cf.x86_64.rpm SHA-256: 6accde895629aa19bbb234ba490768b39fa8a8e911c7a28c57ff4cfb5d23d4e1
cfme-lib-5.2.5.3-2.el6cf.x86_64.rpm SHA-256: e5242aa0c411064cd6acfa9d9fe322bff2713f4ba3dddb3a528ac309ab899262
mingw32-cfme-host-5.2.5.3-2.el6cf.x86_64.rpm SHA-256: f50435dbee445e49376efeaba99d44fd5881deb785e289a35a2bae5964a8457f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.