The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1543 advisory.

    Red Hat CloudForms is an on-premise hybrid cloud     Infrastructure-as-a-Service (IaaS) product that lets you create and manage     private and public clouds.

    This update fixes bugs in and adds enhancements to the System Engine     packages, and upgrades the system to CloudForms 1.1.

    This update also fixes the following security issues:

    It was discovered that Katello did not properly check user permissions when     handling certain requests. An authenticated remote attacker could use this     flaw to download consumer certificates or change settings of other users'     systems if they knew the target system's UUID. (CVE-2012-5603)

    It was discovered that Pulp logged administrative passwords to a world     readable log file. A local attacker could use this flaw to control systems     deployed and managed by CloudForms. (CVE-2012-3538)

    It was discovered that the Pulp configuration file pulp.conf was installed     as world readable. A local attacker could use this flaw to view the     administrative password, allowing them to control systems deployed and     managed by CloudForms. (CVE-2012-4574)

    It was discovered that grinder used insecure permissions for its cache     directory. A local attacker could use this flaw to access or modify files     in the cache. (CVE-2012-5605)

    The CVE-2012-5603 issue was discovered by Lukas Zapletal of Red Hat;
    CVE-2012-3538 was discovered by James Laska of Red Hat; CVE-2012-4574 was     discovered by Kurt Seifried of Red Hat; and CVE-2012-5605 was discovered by     James Labocki of Red Hat.

    After upgrading to these new packages, follow the instructions in the 4.1.
    Upgrading CloudForms System Engine section of the CloudForms 1.1     Installation Guide:

    https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/index.html

    To view the full list of changes in this update, view the CloudForms     Technical Notes:

    https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Technical_Notes/index.html

    Users are advised to upgrade to these updated CloudForms System Engine     packages, which resolve these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモート Redhat Enterprise Linux 5 / 6 ホストに、RHSA-2012:1543 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - katello: 全管理者パスワードが誰でも読み取り可能な katello/Production.log に平文で記録されます (CVE-2012-3538)

  - pulp /etc/pulp/pulp.conf は誰でも読み取り可能、デフォルト管理者パスワードを含みます (CVE-2012-4574)

  - CloudForms Karello: proxies_controller.rb での認証の欠如 (CVE-2012-5603)

  - CloudForms grinder: /var/lib/pulp/cache/grinder ディレクトリは誰でも書き込めるようになっています (CVE-2012-5605)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

远程 Redhat Enterprise Linux 5/6 主机上安装的程序包受到 RHSA-2012:1543 公告中提及的多个漏洞影响。

  - katello：pulp 管理员密码以纯文本形式记录在全局可读的 katello/production.log 中 (CVE-2012-3538)

  - pulp /etc/pulp/pulp.conf 全局可读，包含默认管理员密码 (CVE-2012-4574)

  - CloudForms Katello：proxies_controller.rb 中缺少授权 (CVE-2012-5603)

  - CloudForms grinder：/var/lib/pulp/cache/grinder 目录全局可写 (CVE-2012-5605)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Redhat Enterprise Linux 5 / 6 主機上安裝的套件受到 RHSA-2012:1543 公告中提及的多個弱點影響。

  - katello：在任何人皆可讀取的 katello/production.log 中，以純文字記錄的 pulp 系統管理員密碼 (CVE-2012-3538)

  - pulp /etc/pulp/pulp.conf 任何人皆可讀取，包含預設系統管理員密碼 (CVE-2012-4574)

  - CloudForms Katello：proxies_controller.rb 中缺少授權 (CVE-2012-5603)

  - CloudFormsgrinder：/var/lib/pulp/cache/grinder 目錄任何人皆可修改 (CVE-2012-5605)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
193973	RHEL 5 / 6 : CloudForms System Engine 1.1 update (Important) (RHSA-2012:1543)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/4	medium
193973	RHEL 5 / 6: CloudForms System Engine 1.1 の更新 (重要度高) (RHSA-2012:1543)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/4	medium
193973	RHEL 5 / 6：CloudForms System Engine 1.1 更新（重要）(RHSA-2012:1543)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/4	medium
193973	RHEL 5 / 6：CloudForms System Engine 1.1 更新 (重要) (RHSA-2012:1543)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/4	medium

检测

插件搜索

medium

medium

medium

medium