PT-2010-4306 · Red Hat · Red Hat Enterprise Virtualization

Petr Matousek · Publicado 2010-08-24 · Atualizado 2010-08-25 · CVE-2010-2811

Positive Technologies (AI Summary)

CVSS v2.0

5.7

Média

Vetor base

AV:A/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization (RHEV) version 2.2

Description The issue is related to the Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV), which does not properly handle TCP connections for SSL sessions. This allows remote attackers to cause a denial of service, resulting in a daemon outage, by sending crafted SSL traffic.

Recommendations For Red Hat Enterprise Virtualization (RHEV) version 2.2, consider restricting SSL traffic to trusted sources until a fix is available. As a temporary workaround, limiting the exposure of VDSM to untrusted networks may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2010-2811

RHSA-2010:0622

RHSA-2010:0628

Produtos afetados

Red Hat Enterprise Virtualization

Referências · 6

• http://securitytracker.com/id?1024347 · Nota
• https://rhn.redhat.com/errata/RHSA-2010-0628.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=622928 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2811 · Nota de Segurança
• http://securityfocus.com/bid/42580 · Nota
• https://rhn.redhat.com/errata/RHSA-2010-0622.html · Aviso do Fabricante