Bug 974267 (CVE-2013-2176)

Summary: CVE-2013-2176 rhev-m: rhev-apt service unquoted search path
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: acathrow, bazulay, idith, iheim, jbelka, jkt, jrusnack, lpeer, lveyde, pstehlik, rcvalle, security-response-team, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: rhev-guest-tools-iso-3.2-11 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-24 14:05:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 962364, 974280    
Bug Blocks: 974282, 986950    

Description Petr Matousek 2013-06-13 19:31:58 UTC 
An unquoted search path flaw was found in the way the Red Hat Enterprise Virtualization Apt service was installed on Windows. Depending on the permissions of the directories in the unquoted search path, a local, unprivileged user could use this flaw to have a binary of their choosing executed with SYSTEM privileges.

Acknowledgements:

This issue was discovered by Jiri Belka of Red Hat.
Comment 12 errata-xmlrpc 2013-07-31 18:08:05 UTC 
This issue has been addressed in following products:

  RHEV Manager version 3.2

Via RHSA-2013:1122 https://rhn.redhat.com/errata/RHSA-2013-1122.html