Bug 800688 (CVE-2012-1145) - CVE-2012-1145 satellite: remote package upload without authorization
Summary: CVE-2012-1145 satellite: remote package upload without authorization
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-1145
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Jan Hutař
URL:
Whiteboard:
Depends On: 791231 802834 808187 824038
Blocks: 800691
TreeView+ depends on / blocked
 
Reported: 2012-03-06 23:17 UTC by Vincent Danen
Modified: 2021-02-24 12:58 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-09-21 09:59:24 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0436 0 normal SHIPPED_LIVE Moderate: Red Hat Network Satellite spacewalk-backend security update 2012-03-29 22:31:19 UTC

Description Vincent Danen 2012-03-06 23:17:36 UTC
It was discovered that a remote attacker was able to upload a package to a Spacewalk/Satellite NULL organization without any authorization or authentication.  A NULL organization is one to which packages synced from Red Hat Network Hosted land.  Although an attacker is not able to put packages into an arbitrary channel, he could upload several packages and fill up the /var partition with such files.  While these packages are not copied to legitimate channels and would not be downloaded by client systems, a full partition would prevent the downloading of new legitimate packages, which may include security fixes.  These packages would then be unavailable to client systems.

Comment 15 Vincent Danen 2012-03-29 18:28:35 UTC
Statement:

This vulnerability only applies to RHN Satellite 5.4 when running on Red Hat Enterprise Linux 6 under mod_wsgi.  As the code uses mod_python when performing these checks on Red Hat Enterprise Linux 5, that version is not vulnerable to this flaw.

Comment 16 errata-xmlrpc 2012-03-29 18:34:22 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2012:0436 https://rhn.redhat.com/errata/RHSA-2012-0436.html

Comment 17 Vincent Danen 2012-03-29 18:49:40 UTC
Created spacewalk-backend tracking bugs for this issue

Affects: fedora-all [bug 808187]

Comment 18 Jan Pazdziora (Red Hat) 2012-03-30 14:02:24 UTC
Fixed in Spacewalk master, bd7ad3667f2388ae9929d1dfc03c49545e17384c. Tagged as spacewalk-backend-1.8.9-1.


Note You need to log in before you can comment on or make changes to this bug.