Bug 1602190 (CVE-2018-10905)

Summary:	CVE-2018-10905 cfme: Improper access control in dRuby allows local users to execute arbitrary commands as root
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agrare, cpelland, dajohnso, dclarizi, dmetzger, gblomqui, gmccullo, gtanzill, hhudgeon, jfrey, jhardy, jocarter, jprause, jrafanie, obarenbo, rcosta, rmanes, roliveri, security-response-team, simaishi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cfme 5.8.5.0, cfme 5.9.4.2	Doc Type:	If docs needed, set a value
Doc Text:	CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. An attacker with SSH access to the system can use the dRuby (DRb) module installed on the system to execute arbitrary shell commands using `instance_eval()`.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-26 00:25:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1603578, 1608552
Bug Blocks:	1602174

Description Sam Fowler 2018-07-18 01:29:35 UTC

CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. An attacker with SSH access to the system can use the dRuby (DRb) module installed on the system to execute arbitrary shell commands using `instance_eval()`.

Comment 6 Richard Maciel Costa 2018-07-20 02:34:55 UTC

Mitigation:

Administrators of the CloudForms appliance can filter local packages going to the port where MIQ Server is listening, by using the following iptables command:
# iptables -I OUTPUT 1 -o lo -d localhost/32 -p tcp -m tcp --dport <MIQ Server port> -m owner '!' --uid-owner root -j DROP

Where the MIQ Server port can be found using netstat command:
# netstat -nl --tcp -p | grep -i "miq server"

Comment 11 Richard Maciel Costa 2018-07-23 21:02:32 UTC

Acknowledgments:

Name: Stephen Gappinger (American Express)

Comment 12 errata-xmlrpc 2018-09-04 18:00:24 UTC

This issue has been addressed in the following products:

  CloudForms Management Engine 5.9

Via RHSA-2018:2561 https://access.redhat.com/errata/RHSA-2018:2561

Comment 13 errata-xmlrpc 2018-09-26 18:36:29 UTC

This issue has been addressed in the following products:

  CloudForms Management Engine 5.8

Via RHSA-2018:2745 https://access.redhat.com/errata/RHSA-2018:2745