PT-2011-1364 · Red Hat · Red Hat Network Satellite

Vincent Danen · Published 2011-04-18 · Updated 2022-02-19 · CVE-2010-1171

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Network (RHN) Satellite versions 5.3 through 5.4

Description The issue allows remote authenticated users to access arbitrary files and cause a denial of service, specifically failed yum operations, via vectors related to configuration and package group (comps.xml) files for channels. This is due to the exposure of a dangerous, obsolete XML-RPC API.

Recommendations For versions 5.3 and 5.4, consider disabling the obsolete XML-RPC API as a temporary workaround until a patch is available. Restrict access to configuration and package group files, such as comps.xml, to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1171

RHSA-2011:0434

Affected Products

Red Hat Network Satellite

References · 8

• http://redhat.com/support/errata/RHSA-2011-0434.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=584118 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1171 · Security Note
• http://secunia.com/advisories/44150 · Note
• http://securitytracker.com/id?1025316 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66690 · Note
• http://securityfocus.com/bid/47316 · Note