Bug 882138 (CVE-2012-5605)

Summary:	CVE-2012-5605 CloudForms grinder: /var/lib/pulp/cache/grinder directory is world-writeable
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cpelland, katello-bugs, mmccune, security-response-team
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-08-08 19:28:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	828447
Bug Blocks:	836071

Description Kurt Seifried 2012-11-30 08:58:43 UTC

James Labocki of Red Hat reports:

The /var/lib/pulp/cache/grinder directory is world-writeable

Comment 2 Murray McAllister 2012-12-03 06:20:28 UTC

Acknowledgements:

This issue was discovered by James Labocki of Red Hat.

Comment 3 errata-xmlrpc 2012-12-04 19:58:08 UTC

This issue has been addressed in following products:

  CloudForms for RHEL 6
  CloudForms Tools for RHEL 5

Via RHSA-2012:1543 https://rhn.redhat.com/errata/RHSA-2012-1543.html

Comment 6 Kurt Seifried 2014-08-08 19:28:23 UTC

Statement:

Red Hat Update Infrastructure 2.1.3 is now in Production 2 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Update Infrastructure Life Cycle: https://access.redhat.com/support/policy/updates/rhui.