Bug 1187340 (CVE-2014-8163)

Summary:	CVE-2014-8163 Satellite5: upload_crash_file and upload_result directory traversal
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cpelland, cperry, mmccune, security-response-team, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that an XMLRPC interface exposed by Satellite could allow an attacker to write arbitrary files and directories under the /var/satellite directory on the Satellite server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:50:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1181470, 1187346

Description Kurt Seifried 2015-01-29 19:34:22 UTC

Travis Emmert reports:

An XMLRPC interface is exposed that is intended for programmatic invocation 
from the client programs and related components. This interfaces exists on the 
satellite server at /XMLRPC. Note that this interface is different from the 
published interface exposed to endusers at /rpc/api. The application accepts 
data and a filename for writing the file too. The filename and resulting 
generated path is inspected, however the inspection does not consider all 
potential attacks. The verification on the path results in a situation where 
an attacker can write to an arbitrary file and directory under /var/satellite/

Comment 2 Kurt Seifried 2015-05-11 16:13:13 UTC

Acknowledgement:

Red Hat would like to thank Travis Emmert for reporting this issue.