Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2016.0637 Important: redhat-support-plugin-rhev security, bug fix and enhancement update 10 March 2016 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: redhat-support-plugin-rhev Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 6 Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2015-7544 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2016-0426.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: redhat-support-plugin-rhev security, bug fix and enhancement update Advisory ID: RHSA-2016:0426-01 Product: Red Hat Enterprise Virtualization Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0426.html Issue date: 2016-03-09 CVE Names: CVE-2015-7544 ===================================================================== 1. Summary: Updated redhat-support-plugin-rhev packages that fix a security flaw and a bug are now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEV-M 3.6 - noarch 3. Description: The Red Hat Support plug-in for Red Hat Enterprise Virtualization offers seamless integrated access to Red Hat subscription services from the Red Hat Enterprise Virtualization administration portal. The plug-in provides automated functionality that enables quicker help, answers, and proactive services. It offers easy and instant access to Red Hat exclusive knowledge, resources, engagement, and diagnostic features. It was found that redhat-support-plugin-rhev passed a user-specified path and file name directly to the command line in the log viewer component. This could allow users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment. (CVE-2015-7544) All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1138310 - [Tracker] - Building redhat-support-plugin-rhev for 3.6 1173074 - Red Hat Access: Support stucked after upload failure 1269588 - CVE-2015-7544 redhat-support-plugin-rhev: Remote code execution by SuperUser role on hosts in RHEV 6. Package List: RHEV-M 3.6: Source: redhat-support-plugin-rhev-3.6.0-12.el6.src.rpm noarch: redhat-support-plugin-rhev-3.6.0-12.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7544 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFW4Iq/XlSAg2UNWIIRAiD1AKC7OP2CRGKWcqZ8nLmV2listn8jIACcDXOR 1hwmwEwzV7j5RTVWDzau8dA= =E13l - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVuCycX6ZAP0PgtI9AQIuwA/+PIPYzeTcA2Ok4hP1uqpNN/QlkGlboBgx 4bWqd14yh4GibDcda2uu1dvQv4NodXRBlsP4VMvFg110PgxcTq39xpFPBzey2ls9 p8F8qa7FtVJnO3GbYxQF27aAyK7YMsaM9Ol5dpmzYZrSewCiTxX25iHN2nMhVK9I honoNQuS7wcWGribzwVrMLRlUVP8thsfeeTQni8iBN7CqWKmmA7fDO9OVlEtqKfY sHA63Mf80GIpDRu+dT2m2ZtUf0HixO+U/WfcfWiniLLzSJ1/tG+RJiundbm5j/RO 70QL0Hn6pWyxmOE4diQukjhAINffBzm5yKDKvOlDpS0fmJgNBMh13q1PHBGfL7qN SRK8Eb2PGUPPTKU+b3WOQXv5j+pSVMG51kXObDuL0mzOXECngaNvCVvmUXQ+M0vu r6hlRpOnRy6LvlEWmUM8k1EjC3xiJWOOBIRrNxIgquaGKzeAr6idDIctFxzouzol qK0B/uJhAQxKJGXW1JA40xcidIoJDrf9xRwGqmjHCKaqSsh2reAS605fh2uJleX6 OdCoSJxBzA6RAHxPA0OPelaYEcYQQyLWgJSz7HU80N/K7v5yZO0+OrBwN/Q7qBUn IW3GAdlLv5zj+LIVvIkHBUNU1HrC+kBvy59ZHjzGZKcMUnpAZy9Upo9y9ewy3HE7 Fy0TFTsepNM= =zO0r -----END PGP SIGNATURE-----