PT-2010-4306 · Red Hat · Red Hat Enterprise Virtualization

Petr Matousek · Published 2010-08-24 · Updated 2010-08-25 · CVE-2010-2811

Positive Technologies (AI Summary)

CVSS v2.0

5.7

Medium

Base vector

AV:A/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization (RHEV) version 2.2

Description The issue is related to the Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV), which does not properly handle TCP connections for SSL sessions. This allows remote attackers to cause a denial of service, resulting in a daemon outage, by sending crafted SSL traffic.

Recommendations For Red Hat Enterprise Virtualization (RHEV) version 2.2, consider restricting SSL traffic to trusted sources until a fix is available. As a temporary workaround, limiting the exposure of VDSM to untrusted networks may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2010-2811

RHSA-2010:0622

RHSA-2010:0628

Affected Products

Red Hat Enterprise Virtualization

References · 6

• https://rhn.redhat.com/errata/RHSA-2010-0628.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2811 · Security Note
• https://rhn.redhat.com/errata/RHSA-2010-0622.html · Vendor Advisory
• http://securitytracker.com/id?1024347 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=622928 · Note
• http://securityfocus.com/bid/42580 · Note