RHSA-2014:1317 - Security Advisory

Topic

Updated cfme packages that fix two security issues, several bugs, and add
various enhancements are now available for Red Hat CloudForms 3.1.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control, and
automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails, a
model-view-controller (MVC) framework for web application development.
Action Pack implements the controller and the view components.

It was found that Red Hat CloudForms exposed default routes that were
reachable via HTTP(S) requests. An authenticated user could use this flaw
to access potentially sensitive controllers and actions that would allow
for privilege escalation. (CVE-2014-0140)

It was found that Red Hat CloudForms contained an insecure send method that
accepted user-supplied arguments. An authenticated user could use this flaw
to modify the program flow in a way that could result in privilege
escalation. (CVE-2014-3642)

These issues were discovered by Jan Rusnacko of Red Hat Product Security.

This update also fixes several bugs and adds various enhancements.
Documentation for these changes is available in the Release Notes and
Technical Notes documents linked to in the References section.

All cfme users are advised to upgrade to these updated packages, which
contain correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat CloudForms 3.1 x86_64

Fixes

• BZ - 1077359 - CVE-2014-0140 CFME: default routes expose controllers and actions
• BZ - 1092894 - CVE-2014-3642 CFME: dangerous send method in performance.rb

CVEs

• CVE-2014-0140
• CVE-2014-3642

References

• http://www.redhat.com/security/updates/classification/#moderate