Bug 1540343 – CVE-2017-15136 katello: system registration hostname hijacking results in inability to access updates

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1540343 - (CVE-2017-15136) CVE-2017-15136 katello: system registration hostname hijacking results in inability to access updates

Summary:	CVE-2017-15136 katello: system registration hostname hijacking results in ina...

Status:	NEW

Aliases:	CVE-2017-15136

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180227,reported=2...
Keywords:	Security

Depends On:	1501197 1540345 1540346
Blocks:	1516191
	Show dependency tree / graph

Reported:	2018-01-30 14:55 EST by Kurt Seifried
Modified:	2018-02-28 12:40 EST (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	When registering a system with Satellite 6 a hostname must be specified. if an additional system is registered with the same hostname, the original system will stop receiving updates from Satellite 6. An attacker with administrative privileges to add systems to a Satellite 6 server could exploit this to prevent other hosts from getting security updates.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Kurt Seifried 2018-01-30 14:55:33 EST

Jan Hutař of Red Hat reports:

When registering and activating a new system with Satellite 6 if the
new systems hostname is then reset to the hostname of a previously
registered system the previously registered system will lose access to
updates including security updates.

Comment 1 Kurt Seifried 2018-01-30 14:55:39 EST

Acknowledgments:

Name: Jan Hutař (Red Hat)

Note You need to log in before you can comment on or make changes to this bug.