You are here

V-163: Red Hat Network Satellite Server Inter-Satellite Sync Remote Authentication Bypass

May 24, 2013 - 6:00am

Addthis

PROBLEM:

A vulnerability was reported in Red Hat Network Satellite Server

PLATFORM:

Red Hat Network Satellite (v. 5.3 for RHEL 5)
Red Hat Network Satellite (v. 5.4 for RHEL 5)
Red Hat Network Satellite (v. 5.4 for RHEL 6)
Red Hat Network Satellite (v. 5.5 for RHEL 5)
Red Hat Network Satellite (v. 5.5 for RHEL 6)

ABSTRACT:

The system does not properly validate all Inter-Satellite Sync operations

REFERENCE LINKS:

SecurityTracker Alert ID:  1028587
RHSA-2013:0848-1
CVE-2013-2056

IMPACT ASSESSMENT:

Medium

DISCUSSION:

It was discovered that Red Hat Network Satellite did not fully check the authenticity of a client beyond the initial authentication check during an Inter-Satellite Sync operation. If a remote attacker were to modify the satellite-sync client to skip the initial authentication call, they could obtain all channel content from any Red Hat Network Satellite server that could be reached, even if Inter-Satellite Sync support was disabled.

IMPACT:

A remote user can bypass authentication to gain access to all channel content on the target server.

SOLUTION:

Vendor recommends upgrading to the updated packages

Addthis