Bug 1189085 (CVE-2015-0257)

Summary:	CVE-2015-0257 ovirt-engine-dwh: incorrect permissions on plugin file containing passwords
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acathrow, alonbl, bazulay, bmcclain, dblechte, didi, ecohen, gklein, idith, iheim, jrusnack, lsurette, michal.skrivanek, rbalakri, Rhev-m-bugs, sradco, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that a directory shared between the ovirt-engine-dwhd service and a plug-in used during the service's startup had incorrect permissions. A local user could use this flaw to access files in this directory, which could potentially contain sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-04-29 04:06:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1189087, 1189088
Bug Blocks:	1189044

Description Wade Mealing 2015-02-04 12:22:00 UTC

A flaw was discovered in the permissions on a directory shared by the ovirt-engine-dwhd and a plugin used during service startup.   The permission
allowed any system level user to read login and password permissions for the database.  This may allow an attacker to falsify business inteligence
data or deny access to business intelligence by modifying the contents of a plugin settings file used by the ovirt-engine-dwh component.

Comment 4 Wade Mealing 2015-02-05 03:16:16 UTC

Acknowledgements:

This issue was discovered by Yedidyah Bar David of the Red Hat Enterprise Virtualization team.

Comment 5 errata-xmlrpc 2015-04-28 18:46:26 UTC

This issue has been addressed in the following products:

  RHEV Manager version 3.5

Via RHSA-2015:0888 https://rhn.redhat.com/errata/RHSA-2015-0888.html