Bug 1189085 – CVE-2015-0257 ovirt-engine-dwh: incorrect permissions on plugin file containing passwords

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1189085 - (CVE-2015-0257) CVE-2015-0257 ovirt-engine-dwh: incorrect permissions on plugin file containing passwords

Summary:	CVE-2015-0257 ovirt-engine-dwh: incorrect permissions on plugin file containi...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-0257

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20150104,reported=2...
Keywords:	Security

Depends On:	1189087 1189088
Blocks:	1189044
	Show dependency tree / graph

Reported:	2015-02-04 07:22 EST by Wade Mealing
Modified:	2015-04-29 00:06 EDT (History)
CC List:	17 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was discovered that a directory shared between the ovirt-engine-dwhd service and a plug-in used during the service's startup had incorrect permissions. A local user could use this flaw to access files in this directory, which could potentially contain sensitive information.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-04-29 00:06:57 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0888	normal	SHIPPED_LIVE	Moderate: Red Hat Enterprise Virtualization Manager 3.5.1 update	2015-04-28 18:40:04 EDT

Groups: None (edit)

Description Wade Mealing 2015-02-04 07:22:00 EST

A flaw was discovered in the permissions on a directory shared by the ovirt-engine-dwhd and a plugin used during service startup.   The permission
allowed any system level user to read login and password permissions for the database.  This may allow an attacker to falsify business inteligence
data or deny access to business intelligence by modifying the contents of a plugin settings file used by the ovirt-engine-dwh component.

Comment 4 Wade Mealing 2015-02-04 22:16:16 EST

Acknowledgements:

This issue was discovered by Yedidyah Bar David of the Red Hat Enterprise Virtualization team.

Comment 5 errata-xmlrpc 2015-04-28 14:46:26 EDT

This issue has been addressed in the following products:

  RHEV Manager version 3.5

Via RHSA-2015:0888 https://rhn.redhat.com/errata/RHSA-2015-0888.html

Note You need to log in before you can comment on or make changes to this bug.