PT-2013-1900 · Red Hat · Red Hat Enterprise Virtualization Manager

Andrew Cathrow · Published 2013-03-12 · Updated 2023-02-13 · CVE-2012-6115

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization Manager versions 3.1 and earlier

Description The issue affects the domain management tool, specifically when the validate action is enabled, causing the administrative password to be logged to a world-readable log file. This allows local users to obtain sensitive information by reading the log file.

Recommendations For Red Hat Enterprise Virtualization Manager versions 3.1 and earlier, consider disabling the validate action in the domain management tool to prevent the administrative password from being logged to a world-readable log file. Restrict access to the log file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-6115

RHSA-2013:0211

Affected Products

Red Hat Enterprise Virtualization Manager

References · 7

• http://rhn.redhat.com/errata/RHSA-2013-0211.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6115 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=893355 · Note
• http://securityfocus.com/bid/57749 · Note
• http://securitytracker.com/id/1028076 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81833 · Note
• http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commit%3Bh=e8c72daec4efa8be0fcd8ea55c41e855ddd8eedf · Note