-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: CloudForms Cloud Engine 1.1.2 update
Advisory ID:       RHSA-2013:0545-01
Product:           Red Hat CloudForms
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2013-0545.html
Issue date:        2013-02-21
CVE Names:         CVE-2012-5509 CVE-2012-6117 CVE-2012-6118 
=====================================================================

1. Summary:

CloudForms Cloud Engine 1.1.2 is now available.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

CloudForms Cloud Engine for RHEL 6 Server - noarch

3. Description:

Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds. It provides self-service computing resources to
users in a managed, governed, and secure way. CloudForms Cloud Engine is a
management application for cloud resources.

It was found that the Aeolus Configuration Server stored passwords in plain
text in the world-readable "/var/log/aeolus-configserver/configserver.log"
file. A local attacker could use this flaw to obtain the administrative
passwords for other services (such as Katello, databases, and so on).
(CVE-2012-6117)

It was found that Conductor, the web-based management console, allowed
unprivileged users to modify their quota for the number of instances they
are allowed to run. An unprivileged user could use this flaw to monopolize
resources and run more instances than intended. (CVE-2012-6118)

It was found that the aeolus-configserver-setup script created a
world-readable file containing authentication details in plain text in the
"/tmp/" directory. A local attacker could use this flaw to obtain Audrey
credentials, allowing them to make configuration changes to Audrey-enabled
instances. (CVE-2012-5509)

The CVE-2012-6117 issue was discovered by James Laska of Red Hat;
CVE-2012-6118 was discovered by Tomas Sedovic of Red Hat; and CVE-2012-5509
was discovered by Aaron Weitekamp of the Red Hat Cloud Quality Engineering
team.

This update also fixes the following bug:

* A bug in the initial filter view for instances caused stopped instances
to display for the default "Non stopped applications" option until
auto-refresh. This bug fix corrects the form rendering for the filter view.
The filter view now displays only non-stopped instances. (BZ#895569)

Additionally, this update adds the following enhancements:

* Red Hat Enterprise Linux 5.9 support to guest image building in
CloudForms Cloud Engine. (BZ#903646)

* Support for Red Hat Enterprise Linux 5.9 Amazon Machine Images (AMI) on
Amazon Web Services (AWS) Elastic Compute Cloud (EC2) providers for
CloudForms Cloud Engine. (BZ#903651)

* Red Hat Enterprise Linux 6.4 support to guest image building in
CloudForms Cloud Engine. (BZ#903395)

* Support for Red Hat Enterprise Linux 6.4 Amazon Machine Images (AMI) on
Amazon Web Services (AWS) Elastic Compute Cloud (EC2) providers for
CloudForms Cloud Engine. (BZ#903650)

Refer to the CloudForms 1.1.2 Release Notes for further information about
this release. The Release Notes will be available shortly from
https://access.redhat.com/knowledge/docs/

To upgrade, follow the upgrade instructions in the CloudForms Installation
Guide:

https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/Updating_CloudForms_Cloud_Engine.html

Users of CloudForms Cloud Engine are advised to upgrade to these updated
packages.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

875294 - CVE-2012-5509 aeolus-configserver: aeolus-configserver-setup /tmp file conductor credentials leak
895569 - Default Filter view option "Non stopped applications" lists stopped instance, and removes them after auto refresh
903395 - Add support for RHEL-6.4 to Oz
903646 - Add support for RHEL-5.9 to Oz
903650 - Update jeos AMI's for RHEL-6.4
903651 - Update jeos AMI's for RHEL-5.9
906192 - CVE-2012-6118 Aeolus Conductor: Unprivileged user can change their own Maximum Running Instances quota
906201 - CVE-2012-6117 Aeolus Configserver: Passwords from application blueprint stored plaintext in configserver.log
912395 - image customization fails using root user, must use ec2-user

6. Package List:

CloudForms Cloud Engine for RHEL 6 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/aeolus-conductor-0.13.26-1.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/aeolus-configserver-0.4.12-3.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/imagefactory-1.0.3-1.el6cf.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/CloudForms/SRPMS/oz-0.8.0-8.el6cf.src.rpm

noarch:
aeolus-all-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-daemons-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-devel-0.13.26-1.el6cf.noarch.rpm
aeolus-conductor-doc-0.13.26-1.el6cf.noarch.rpm
aeolus-configserver-0.4.12-3.el6cf.noarch.rpm
imagefactory-1.0.3-1.el6cf.noarch.rpm
imagefactory-jeosconf-ec2-fedora-1.0.3-1.el6cf.noarch.rpm
imagefactory-jeosconf-ec2-rhel-1.0.3-1.el6cf.noarch.rpm
oz-0.8.0-8.el6cf.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-5509.html
https://www.redhat.com/security/data/cve/CVE-2012-6117.html
https://www.redhat.com/security/data/cve/CVE-2012-6118.html
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/knowledge/docs/
https://access.redhat.com/knowledge/docs/en-US/CloudForms/1.1/html/Installation_Guide/Updating_CloudForms_Cloud_Engine.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2013 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFRJnQVXlSAg2UNWIIRAg1XAKCdQz9OAxS3wA516u3tkZNbUEMUqACfUz8j
2cKPvsz+MCt3WTl+vIgXyR8=
=nMZt
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce