Bug 800688 (CVE-2012-1145)

Summary:	CVE-2012-1145 satellite: remote package upload without authorization
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	Jan Hutař <jhutar>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cperry, jpazdziora, mmraka, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-09-21 09:59:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	791231, 802834, 808187, 824038
Bug Blocks:	800691

Description Vincent Danen 2012-03-06 23:17:36 UTC

It was discovered that a remote attacker was able to upload a package to a Spacewalk/Satellite NULL organization without any authorization or authentication.  A NULL organization is one to which packages synced from Red Hat Network Hosted land.  Although an attacker is not able to put packages into an arbitrary channel, he could upload several packages and fill up the /var partition with such files.  While these packages are not copied to legitimate channels and would not be downloaded by client systems, a full partition would prevent the downloading of new legitimate packages, which may include security fixes.  These packages would then be unavailable to client systems.

Comment 15 Vincent Danen 2012-03-29 18:28:35 UTC

Statement:

This vulnerability only applies to RHN Satellite 5.4 when running on Red Hat Enterprise Linux 6 under mod_wsgi.  As the code uses mod_python when performing these checks on Red Hat Enterprise Linux 5, that version is not vulnerable to this flaw.

Comment 16 errata-xmlrpc 2012-03-29 18:34:22 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2012:0436 https://rhn.redhat.com/errata/RHSA-2012-0436.html

Comment 17 Vincent Danen 2012-03-29 18:49:40 UTC

Created spacewalk-backend tracking bugs for this issue

Affects: fedora-all [bug 808187]

Comment 18 Jan Pazdziora 2012-03-30 14:02:24 UTC

Fixed in Spacewalk master, bd7ad3667f2388ae9929d1dfc03c49545e17384c. Tagged as spacewalk-backend-1.8.9-1.