Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0269
Moderate: CloudForms Cloud Engine 1.1.2 update
22 February 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: CloudForms Cloud Engine
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Impact/Access: Administrator Compromise -- Existing Account
Access Confidential Data -- Existing Account
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2012-6118 CVE-2012-6117 CVE-2012-5509
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2013-0545.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: CloudForms Cloud Engine 1.1.2 update
Advisory ID: RHSA-2013:0545-01
Product: Red Hat CloudForms
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0545.html
Issue date: 2013-02-21
CVE Names: CVE-2012-5509 CVE-2012-6117 CVE-2012-6118
=====================================================================
1. Summary:
CloudForms Cloud Engine 1.1.2 is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
CloudForms Cloud Engine for RHEL 6 Server - noarch
3. Description:
Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds. It provides self-service computing resources to
users in a managed, governed, and secure way. CloudForms Cloud Engine is a
management application for cloud resources.
It was found that the Aeolus Configuration Server stored passwords in plain
text in the world-readable "/var/log/aeolus-configserver/configserver.log"
file. A local attacker could use this flaw to obtain the administrative
passwords for other services (such as Katello, databases, and so on).
(CVE-2012-6117)
It was found that Conductor, the web-based management console, allowed
unprivileged users to modify their quota for the number of instances they
are allowed to run. An unprivileged user could use this flaw to monopolize
resources and run more instances than intended. (CVE-2012-6118)
It was found that the aeolus-configserver-setup script created a
world-readable file containing authentication details in plain text in the
"/tmp/" directory. A local attacker could use this flaw to obtain Audrey
credentials, allowing them to make configuration changes to Audrey-enabled
instances. (CVE-2012-5509)
The CVE-2012-6117 issue was discovered by James Laska of Red Hat;
CVE-2012-6118 was discovered by Tomas Sedovic of Red Hat; and CVE-2012-5509
was discovered by Aaron Weitekamp of the Red Hat Cloud Quality Engineering
team.
This update also fixes the following bug:
* A bug in the initial filter view for instances caused stopped instances
to display for the default "Non stopped applications" option until
auto-refresh. This bug fix corrects the form rendering for the filter view.
The filter view now displays only non-stopped instances. (BZ#895569)
Additionally, this update adds the following enhancements:
* Red Hat Enterprise Linux 5.9 support to guest image building in
CloudForms Cloud Engine. (BZ#903646)
* Support for Red Hat Enterprise Linux 5.9 Amazon Machine Images (AMI) on
Amazon Web Services (AWS) Elastic Compute Cloud (EC2) providers for
CloudForms Cloud Engine. (BZ#903651)
* Red Hat Enterprise Linux 6.4 support to guest image building in
CloudForms Cloud Engine. (BZ#903395)
* Support for Red Hat Enterprise Linux 6.4 Amazon Machine Images (AMI) on
Amazon Web Services (AWS) Elastic Compute Cloud (EC2) providers for
CloudForms Cloud Engine. (BZ#903650)
Refer to the CloudForms 1.1.2 Release Notes for further information about
this release. The Release Notes will be available shortly from
https://access.redhat.com/knowledge/docs/
To upgrade, follow the upgrade instructions in the CloudForms Installation
Guide:
https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/Updating_CloudForms_Cloud_Engine.html
Users of CloudForms Cloud Engine are advised to upgrade to these updated
packages.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
875294 - CVE-2012-5509 aeolus-configserver: aeolus-configserver-setup /tmp file conductor credentials leak
895569 - Default Filter view option "Non stopped applications" lists stopped instance, and removes them after auto refresh
903395 - Add support for RHEL-6.4 to Oz
903646 - Add support for RHEL-5.9 to Oz
903650 - Update jeos AMI's for RHEL-6.4
903651 - Update jeos AMI's for RHEL-5.9
906192 - CVE-2012-6118 Aeolus Conductor: Unprivileged user can change their own Maximum Running Instances quota
906201 - CVE-2012-6117 Aeolus Configserver: Passwords from application blueprint stored plaintext in configserver.log
912395 - image customization fails using root user, must use ec2-user
6. Package List:
CloudForms Cloud Engine for RHEL 6 Server:
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/aeolus-conductor-0.13.26-1.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/aeolus-configserver-0.4.12-3.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/imagefactory-1.0.3-1.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/oz-0.8.0-8.el6cf.src.rpm
noarch:
aeolus-all-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-daemons-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-devel-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-doc-0.13.26-1.el6cf.noarch.rpm
aeolus-configserver-0.4.12-3.el6cf.noarch.rpm
imagefactory-1.0.3-1.el6cf.noarch.rpm
imagefactory-jeosconf-ec2-fedora-1.0.3-1.el6cf.noarch.rpm
imagefactory-jeosconf-ec2-rhel-1.0.3-1.el6cf.noarch.rpm
oz-0.8.0-8.el6cf.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2012-5509.html
https://www.redhat.com/security/data/cve/CVE-2012-6117.html
https://www.redhat.com/security/data/cve/CVE-2012-6118.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/knowledge/docs/
https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/Updating_CloudForms_Cloud_Engine.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFRJnQVXlSAg2UNWIIRAg1XAKCdQz9OAxS3wA516u3tkZNbUEMUqACfUz8j
2cKPvsz+MCt3WTl+vIgXyR8=
=nMZt
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUScTiu4yVqjM2NGpAQJtMxAAousTFyK0BN77j2UlI41ENv2RmHoZyKxj
2nh8fuKOVjPEk6E9EhFZpEjPpjhtFE/yPbbjlTR2uScc6T8T/4J3zOMAraH9iBHi
4V3Bskp3OoXKeF9xbMhS6LIsfJ41z3oGecse9zOthCwHesSNm3hcCexz+tZWika8
bjUN9tZxlY1XkPrFTlwcPTMBpdI5t/PK04of4ePvQ/TgdCr87ovTgbSCgYtcU8Wv
pJ4jI7E5hv/s/F+TvTfx8J+fGA5MSgzaULkjHqBIYQVYLr89GuN5vsYm4cotxSVW
LU9AaJyYpBD7dNVOmzzXBohxYm/gQkpLS6gUxnMa/4hRY/9myBrVmMMmy2d5Lt9U
qGxR/5bi19rwZ7qvU13vmSnu+LuvJLFfJ7CqiAcA2zOtNSjrNIzWcfaPLcMl18To
diEUgOXEla8t+6lHeHJ3vl1DBCdB8qwex+wQBsKbnN3q4KUcn4eiWq8alRkamPsn
8B5kVGeMMD7rojzOQNWgkXRsKKrjh8KazCHJBI1se79WTli51MgRzFGyPOtu0Dwx
l+GG2vXBYnhTNGH1mSJNVWVMHu+w7qi9LVa6+VAv3DxYQ8Tw329MOkxlAZporzfq
gmgrdInozGDDeLZBhCV+2r4OizJ33PsPejjuNQotHch1yuxUfGobS7pMs49XFJ20
SgPpPKhtAJk=
=oKam
-----END PGP SIGNATURE-----