Red Hat update for Satellite 6.3

1) Cross-site scripting

EUVDB-ID: #VU10730

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2013-6459

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The weakness exists due to an input validation error in the will_paginate gem before 3.0.5 for Ruby. A remote authenticated attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU10731

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-8183

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper enforcement of access controls on certain resources. A remote attacker can access resources in other organizations.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU10733

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1669

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to buffer overflow in the zone.cc. A remote attacker can send specially crafted JavaScript code, trigger buffer overflow and cause the application to crash.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU10736

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-3693

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to a provisioning template containing `inspect` when initialized with a delegate object that is a Rails controller. A remote context-dependent attacker can use the inspect method and access sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU10739

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-3696

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists in the pulp-qpid-ssl-cfg script due to creation of the private CA key in a directory that is world-readable for a small amount of time. A local attacker can gain access to the private key information in the file.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU10741

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-3704

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to unsafe use of Bash's $RANDOM that generates a NSS DB password and seed resulting in insufficient randomness. A remote attacker can potentially guess the seed used given enough time and compute resources.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Privilege escalation

EUVDB-ID: #VU10746

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-4451

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to bypass security restrictions.

The weakness exists due to improper enforcement of access controls on certain resources. A remote attacker can bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Information disclosure

EUVDB-ID: #VU10749

Risk: Low

CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-4995

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to improper restriction of access to preview provisioning templates. A remote attacker with permissions to preview host templates can access the template preview for any host if they are able to guess the host name, and access potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU10753

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-4996

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists in the discovery-debug due to improper security restrictions. A local attacker with access to the system journal can obtain the root password by reading the system journal, or by clicking Logs on the console.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Cross-site scripting

EUVDB-ID: #VU10754

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-6319

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in app/helpers/form_helper.rb, as used by Remote Execution and possibly other plugins, when processing label parameter. A remote attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Cross-site scripting

EUVDB-ID: #VU10755

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-8639

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information disclosure

EUVDB-ID: #VU10758

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9593

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in the foreman-debug's logging due to improper security restrictions. A local attacker with access to the foreman log file can view passwords that allow to access those systems.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper access control

EUVDB-ID: #VU10759

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9595

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to launch a symlink attack on the target system.

The weakness exists in the katello-debug due to insecure usage of temporary files by certain scripts and log files. A local attacker can create a symbolic link from a temporary file to various files on the system, bypass local access protections to overwrite the contents of arbitrary files.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Man-in-the-middle attack

EUVDB-ID: #VU10760

Risk: Low

CVSSv4.0: 4.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-2667

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to conduct man-in-the-middle attack.

The weakness exists in the hammer_cli command line client due to disability of SSL/TLS certificate verification by default. An adjacent attacker can use man-in-the-middle techniques to spoof a valid certificate.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Information disclosure

EUVDB-ID: #VU10762

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-2672

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the foreman's logging due to improper security restrictions during the adding or registering of images. A remote attacker with access to the foreman log file can view passwords for provisioned systems in the log file that allow to access those systems.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Satellite: 6.3

CPE2.3

• cpe:2.3:a:red_hat:red_hat_satellite:6.3:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2018:0336

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.