Bug 959041 – CVE-2013-2049 CloudForms Management Engine 2: static secret_token.rb value

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 959041 - (CVE-2013-2049) CVE-2013-2049 CloudForms Management Engine 2: static secret_token.rb value

Summary:	CVE-2013-2049 CloudForms Management Engine 2: static secret_token.rb value

Status:	CLOSED CURRENTRELEASE

Aliases:	CVE-2013-2049

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20131113,repo...
Keywords:	Security

Depends On:	959042 959045
Blocks:	959043 1011266
	Show dependency tree / graph

Reported:	2013-05-03 00:39 EDT by Kurt Seifried
Modified:	2013-11-12 20:39 EST (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-11-12 20:39:09 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Kurt Seifried 2013-05-03 00:39:05 EDT

Ruby on Rails uses a HMAC for verifying the integrity of signed cookies. To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie.

It was found that CloudForms Management Engine (CFME) is using a statically defined secret, which is common across all deployments. A remote attacker could use this statically defined secret to perform a session tampering attack.

External references:

http://blog.phusion.nl/2013/01/04/securing-the-rails-session-secret/
http://blog.mhartl.com/2008/08/15/a-security-issue-with-rails-secret-session-keys/

Comment 4 Kurt Seifried 2013-10-22 01:11:12 EDT

Acknowledgements:

This issue was discovered by Ramon de C Valle of the Red Hat Product Security Team.

Comment 6 David Jorm 2013-11-12 20:39:09 EST

Statement:

This issue is resolved in CloudForms 3.0. The maintenance support policy for CloudForms 2.0 only covers critical security issues, meaning this issue is out of scope. Users of CloudForms 2.0 are advised to upgrade to CloudForms 3.0 to address this issue.

Note You need to log in before you can comment on or make changes to this bug.