PT-2012-4767 · Red Hat · Katello

Lzap · Publicado 2012-08-25 · Atualizado 2024-02-13 · CVE-2012-3503

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Katello versions 1.0 and earlier

Description The installation script does not properly generate the Application.config.secret token value, resulting in each default installation having the same secret token. This allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret token.

Recommendations For Katello versions 1.0 and earlier, consider regenerating the Application.config.secret token value to a unique and secure token to prevent unauthorized access. As a temporary workaround, restrict access to the CloudForms System Engine web interface until a secure secret token can be generated.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2012-3503

GHSA-5XV2-Q475-RWRH

Produtos afetados

Katello

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/katello/CVE-2012-3503.yml · Exploit
• 🔥 https://github.com/Katello/katello/commit/7c256fef9d75029d0ffff58ff1dcda915056d3a3 · Exploit
• https://github.com/Katello/katello · Nota
• https://github.com/Katello/katello/pull/499 · Nota
• http://secunia.com/advisories/50344 · Nota
• https://github.com/advisories/GHSA-5xv2-q475-rwrh · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1187.html · Aviso do Fabricante
• https://web.archive.org/web/20200229120740/http://securityfocus.com/bid/55140 · Nota
• http://securityfocus.com/bid/55140 · Nota
• https://osv.dev/vulnerability/GHSA-5xv2-q475-rwrh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3503 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2012-1186.html · Aviso do Fabricante
• https://web.archive.org/web/20140806122239/http://secunia.com/advisories/50344 · Nota