PT-2011-1364 · Red Hat · Red Hat Network Satellite

Vincent Danen · Publicado 2011-04-18 · Atualizado 2022-02-19 · CVE-2010-1171

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Network (RHN) Satellite versions 5.3 through 5.4

Description The issue allows remote authenticated users to access arbitrary files and cause a denial of service, specifically failed yum operations, via vectors related to configuration and package group (comps.xml) files for channels. This is due to the exposure of a dangerous, obsolete XML-RPC API.

Recommendations For versions 5.3 and 5.4, consider disabling the obsolete XML-RPC API as a temporary workaround until a patch is available. Restrict access to configuration and package group files, such as comps.xml, to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1171

RHSA-2011:0434

Produtos afetados

Red Hat Network Satellite

Referências · 8

• http://secunia.com/advisories/44150 · Nota
• http://redhat.com/support/errata/RHSA-2011-0434.html · Aviso do Fabricante
• http://securitytracker.com/id?1025316 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=584118 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0967 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1171 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66690 · Nota
• http://securityfocus.com/bid/47316 · Nota