[RHSA-2008:0261-01] Moderate: Red Hat Network Satellite Server security update
bugzilla at redhat.com
bugzilla at redhat.com
Tue May 20 14:18:25 UTC 2008
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Network Satellite Server security update
Advisory ID: RHSA-2008:0261-01
Product: Red Hat Network Satellite Server
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0261.html
Issue date: 2008-05-20
CVE Names: CVE-2004-0885 CVE-2005-0605 CVE-2005-2090
CVE-2005-3510 CVE-2005-3964 CVE-2005-4838
CVE-2006-0254 CVE-2006-0898 CVE-2006-1329
CVE-2006-3835 CVE-2006-5752 CVE-2006-7195
CVE-2006-7196 CVE-2006-7197 CVE-2007-0243
CVE-2007-0450 CVE-2007-1349 CVE-2007-1355
CVE-2007-1358 CVE-2007-1860 CVE-2007-2435
CVE-2007-2449 CVE-2007-2450 CVE-2007-2788
CVE-2007-2789 CVE-2007-3304 CVE-2007-3382
CVE-2007-3385 CVE-2007-4465 CVE-2007-5000
CVE-2007-5461 CVE-2007-5961 CVE-2007-6306
CVE-2007-6388 CVE-2008-0128
=====================================================================
1. Summary:
Red Hat Network Satellite Server version 5.0.2 is now available. This
update includes fixes for a number of security issues in Red Hat Network
Satellite Server components.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Network Satellite Server 5.0 (RHEL v.4 AS) - i386, noarch
3. Description:
During an internal security review, a cross-site scripting flaw was found
that affected the Red Hat Network channel search feature. (CVE-2007-5961)
This release also corrects several security vulnerabilities in various
components shipped as part of the Red Hat Network Satellite Server. In a
typical operating environment, these components are not exposed to users of
Satellite Server in a vulnerable manner. These security updates will reduce
risk in unique Satellite Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting, denial-of-service, or information
disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197,
CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Multiple cross-site scripting flaws were fixed in the image map feature in
the JFreeChart package. (CVE-2007-6306)
Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243,
CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)
Two arbitrary code execution flaws were fixed in the OpenMotif package.
(CVE-2005-3964, CVE-2005-0605)
A flaw which could result in weak encryption was fixed in the
perl-Crypt-CBC package. (CVE-2006-0898)
Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128,
CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355,
CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195,
CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)
Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to
5.0.2, which resolves these issues.
4. Solution:
This update is available via Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
http://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.0.0/html/Installation_Guide/s1-maintenance-update.html
5. Bugs fixed (http://bugzilla.redhat.com/):
396641 - CVE-2007-5961 RHN XSS flaw
444136 - Bring various components of Satellite Server 5.0 up to date
6. Package List:
Red Hat Network Satellite Server 5.0 (RHEL v.4 AS):
i386:
jabberd-2.0s10-3.38.rhn.i386.rpm
java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386.rpm
java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386.rpm
openmotif21-2.1.30-11.RHEL4.6.i386.rpm
openmotif21-debuginfo-2.1.30-11.RHEL4.6.i386.rpm
rhn-apache-1.3.27-36.rhn.rhel4.i386.rpm
rhn-modjk-ap13-1.2.23-2rhn.rhel4.i386.rpm
rhn-modperl-1.29-16.rhel4.i386.rpm
rhn-modssl-2.8.12-8.rhn.10.rhel4.i386.rpm
noarch:
jfreechart-0.9.20-3.rhn.noarch.rpm
perl-Crypt-CBC-2.24-1.el4.noarch.rpm
tomcat5-5.0.30-0jpp_10rh.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0885
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0605
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3964
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4838
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0254
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0898
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1329
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3835
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5752
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0243
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1349
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1355
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1358
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1860
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2435
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2450
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2789
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3382
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5961
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6306
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0128
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFIMt2tXlSAg2UNWIIRAp17AJ9DQrmjPsnrkqqrLuVqycLqLsgg4gCfaPI/
YMauLx8phTfpwKXlATmiQm8=
=juuF
-----END PGP SIGNATURE-----
More information about the RHSA-announce
mailing list