From bugzilla at redhat.com Mon Mar 26 15:31:47 2012 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 26 Mar 2012 15:31:47 +0000 Subject: [RHSA-2012:0421-01] Moderate: rhevm security and bug fix update Message-ID: <201203261531.q2QFVmHi011868@int-mx11.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rhevm security and bug fix update Advisory ID: RHSA-2012:0421-01 Product: Red Hat Enterprise Virtualization Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0421.html Issue date: 2012-03-26 CVE Names: CVE-2012-0818 ===================================================================== 1. Summary: Updated rhevm packages that fix one security issue and various bugs are now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEV-M for Servers - x86_64 3. Description: Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual machines running Red Hat Enterprise Linux and Microsoft Windows. These packages also include the Red Hat Enterprise Virtualization Manager REST (Representational State Transfer) API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager. It was found that RESTEasy was vulnerable to XML External Entity (XXE) attacks. If a remote attacker who is able to access the Red Hat Enterprise Virtualization Manager REST API submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM (Document Object Model) Document and JAXB (Java Architecture for XML Binding) input. (CVE-2012-0818) This update also fixes the following bugs: * Previously the REST API was ignoring the "Accept" header. This made it impossible to retrieve detailed information about specific sub-collections, including hosts and disks. The REST API has been updated and now processes the "Accept" header as originally intended. (BZ#771369) * The "start_time" Virtual Machine property was previously always set. This meant that even Virtual Machines that were stopped, had a value for "start_time". An update has been made to ensure that the "start_time" property is only set when the Virtual Machine has been started, and is running. (BZ#772975) * The 'rhevm-setup' script previously only ran successfully on systems with their locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The script has since been updated to also run successfully in additional locales, including 'ja_JP.UTF-8'. (BZ#784860) * The REST API did not previously validate that all required parameters were provided when enabling power management. The response code returned would also incorrectly indicate the operation had succeeded where mandatory parameters were not supplied. An update has been made to ensure that the power management parameters are validated correctly. (BZ#785744) * Previously no warning or error was issued when the amount of free disk space on a host was low. When no free disk space remained on the host it would become non-responsive with no prior warning. An update has been made to report a warning in the audit log when a host's free disk space is less than 1000 MB, and an error when a host's free disk space is less than 500 MB. (BZ#786132) * When importing Virtual Machines no notification was provided if the MAC address of the network interface card clashed with that of an existing Virtual Machine. Now when this occurs a message is printed to the audit log, highlighting the need for manual intervention. (BZ#795416) * Previously it was not possible to set more, or less, than one value for SpiceSecureChannels using the rhevm-config tool. This meant it was not possible to encrypt all SPICE channels. The rhevm-config tool has been updated and it is now possible to encrypt all SPICE channels, by adding them to the SpiceSecureChannels configuration key. (BZ#784012) All Red Hat Enterprise Virtualization users are advised to upgrade to these updated packages, which address this vulnerability and fix these bugs. Refer to the Solution section for information about installing this update. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Follow the upgrade procedure in the Red Hat Enterprise Virtualization Installation Guide to install these updated packages: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/htm l/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Up grades.html 5. Bugs fixed (http://bugzilla.redhat.com/): 785631 - CVE-2012-0818 RESTEasy: XML eXternal Entity (XXE) flaw 6. Package List: RHEV-M for Servers: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHEV/SRPMS/rhevm-3.0.3_0001-3.el6.src.rpm x86_64: rhevm-3.0.3_0001-3.el6.x86_64.rpm rhevm-backend-3.0.3_0001-3.el6.x86_64.rpm rhevm-config-3.0.3_0001-3.el6.x86_64.rpm rhevm-dbscripts-3.0.3_0001-3.el6.x86_64.rpm rhevm-debuginfo-3.0.3_0001-3.el6.x86_64.rpm rhevm-genericapi-3.0.3_0001-3.el6.x86_64.rpm rhevm-iso-uploader-3.0.3_0001-3.el6.x86_64.rpm rhevm-jboss-deps-3.0.3_0001-3.el6.x86_64.rpm rhevm-log-collector-3.0.3_0001-3.el6.x86_64.rpm rhevm-notification-service-3.0.3_0001-3.el6.x86_64.rpm rhevm-restapi-3.0.3_0001-3.el6.x86_64.rpm rhevm-setup-3.0.3_0001-3.el6.x86_64.rpm rhevm-tools-common-3.0.3_0001-3.el6.x86_64.rpm rhevm-userportal-3.0.3_0001-3.el6.x86_64.rpm rhevm-webadmin-portal-3.0.3_0001-3.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-0818.html https://access.redhat.com/security/updates/classification/#moderate http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFPcIu9XlSAg2UNWIIRAncsAJ9B7Jyw49kqs90XhnHrxk27IeTgzQCfThJK AEh85Iy3CUzWanOyYNwsLnI= =aN3C -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Mar 26 15:32:47 2012 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 26 Mar 2012 15:32:47 +0000 Subject: [RHSA-2012:0422-01] Moderate: rhev-hypervisor6 security and bug fix update Message-ID: <201203261532.q2QFWmem016000@int-mx01.intmail.prod.int.phx2.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rhev-hypervisor6 security and bug fix update Advisory ID: RHSA-2012:0422-01 Product: Red Hat Enterprise Virtualization Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0422.html Issue date: 2012-03-26 CVE Names: CVE-2012-0045 CVE-2012-0207 ===================================================================== 1. Summary: An updated rhev-hypervisor6 package that fixes two security issues and one bug is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEV Hypervisor for RHEL-6 - noarch 3. Description: The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A flaw was found in the way the Linux kernel's KVM hypervisor implementation emulated the syscall instruction for 32-bit guests. An unprivileged guest user could trigger this flaw to crash the guest. (CVE-2012-0045) A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207) Red Hat would like to thank Stephan B?rwolf for reporting CVE-2012-0045, and Simon McVittie for reporting CVE-2012-0207. This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers: CVE-2011-4077, CVE-2011-4081, CVE-2011-4132, CVE-2011-4347, CVE-2011-4594, CVE-2011-4611, CVE-2011-4622 and CVE-2012-0038 (kernel issues) CVE-2012-0444 (libvorbis issue) CVE-2012-0841 (libxml2 issue) This update also fixes the following bug: * The rhev-hypervisor5 and rhev-hypervisor6 packages sometimes updated the symbolic links in the /usr/share/rhev-hypervisor/ directory with incorrect targets. The packages have been updated, they now always update the symbolic links with the correct targets. (BZ#784706) Users of Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 772867 - CVE-2012-0207 kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries 773370 - CVE-2012-0045 kernel: kvm: syscall instruction induced guest panic 796913 - rhev-hypervisor6 6.2 Update 3 Release bugzilla 796915 - RHEV-H 6.2 register to SAM failed via TUI. 798183 - RHEV-H 6.2.z name is incorrect. 6. Package List: RHEV Hypervisor for RHEL-6: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHEV/SRPMS/rhev-hypervisor6-6.2-20120320.0.el6_2.src.rpm noarch: rhev-hypervisor6-6.2-20120320.0.el6_2.noarch.rpm rhev-hypervisor6-tools-6.2-20120320.0.el6_2.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-0045.html https://www.redhat.com/security/data/cve/CVE-2012-0207.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFPcIwMXlSAg2UNWIIRAgEYAJ9xw9B6WxnfvzPT4nTz0nT7VihyoACfSIF1 GijFFMSfiMiULeT3cwThxfw= =lt1E -----END PGP SIGNATURE-----