rhsa-2014_0175
Vulnerability from csaf_redhat
Published
2014-02-13 18:45
Modified
2024-11-14 14:26
Summary
Red Hat Security Advisory: piranha security and bug fix update

Notes

Topic
An updated piranha package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Piranha provides high-availability and load-balancing services for Red Hat Enterprise Linux. The piranha packages contain various tools to administer and configure the Linux Virtual Server (LVS), as well as the heartbeat and failover components. LVS is a dynamically-adjusted kernel routing mechanism that provides load balancing, primarily for Web and FTP servers. It was discovered that the Piranha Configuration Tool did not properly restrict access to its web pages. A remote attacker able to connect to the Piranha Configuration Tool web server port could use this flaw to read or modify the LVS configuration without providing valid administrative credentials. (CVE-2013-6492) This update also fixes the following bug: * When the lvsd service attempted to start, the sem_timedwait() function received the interrupted function call (EINTR) error and exited, causing the lvsd service to fail to start. With this update, EINTR errors are correctly ignored during the start-up of the lvsd service. (BZ#1055709) All piranha users are advised to upgrade to this updated package, which contains backported patches to correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated piranha package that fixes one security issue and one bug is now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having\nImportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Piranha provides high-availability and load-balancing services for Red Hat\nEnterprise Linux. The piranha packages contain various tools to administer\nand configure the Linux Virtual Server (LVS), as well as the heartbeat and\nfailover components. LVS is a dynamically-adjusted kernel routing mechanism\nthat provides load balancing, primarily for Web and FTP servers.\n\nIt was discovered that the Piranha Configuration Tool did not properly\nrestrict access to its web pages. A remote attacker able to connect to the\nPiranha Configuration Tool web server port could use this flaw to read or\nmodify the LVS configuration without providing valid administrative\ncredentials. (CVE-2013-6492)\n\nThis update also fixes the following bug:\n\n* When the lvsd service attempted to start, the sem_timedwait() function\nreceived the interrupted function call (EINTR) error and exited, causing\nthe lvsd service to fail to start. With this update, EINTR errors are\ncorrectly ignored during the start-up of the lvsd service. (BZ#1055709)\n\nAll piranha users are advised to upgrade to this updated package, which\ncontains backported patches to correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0175",
        "url": "https://access.redhat.com/errata/RHSA-2014:0175"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1043040",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043040"
      },
      {
        "category": "external",
        "summary": "1055709",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1055709"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0175.json"
      }
    ],
    "title": "Red Hat Security Advisory: piranha security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T14:26:39+00:00",
      "generator": {
        "date": "2024-11-14T14:26:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2014:0175",
      "initial_release_date": "2014-02-13T18:45:45+00:00",
      "revision_history": [
        {
          "date": "2014-02-13T18:45:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-02-13T18:45:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T14:26:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Load Balancer (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Load Balancer (v. 6)",
                  "product_id": "6Server-LoadBalancer-6.5.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64",
                "product": {
                  "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64",
                  "product_id": "piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/piranha-debuginfo@0.8.6-4.el6_5.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "piranha-0:0.8.6-4.el6_5.2.x86_64",
                "product": {
                  "name": "piranha-0:0.8.6-4.el6_5.2.x86_64",
                  "product_id": "piranha-0:0.8.6-4.el6_5.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/piranha@0.8.6-4.el6_5.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
                "product": {
                  "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
                  "product_id": "piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/piranha-debuginfo@0.8.6-4.el6_5.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "piranha-0:0.8.6-4.el6_5.2.i686",
                "product": {
                  "name": "piranha-0:0.8.6-4.el6_5.2.i686",
                  "product_id": "piranha-0:0.8.6-4.el6_5.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/piranha@0.8.6-4.el6_5.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "piranha-0:0.8.6-4.el6_5.2.src",
                "product": {
                  "name": "piranha-0:0.8.6-4.el6_5.2.src",
                  "product_id": "piranha-0:0.8.6-4.el6_5.2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/piranha@0.8.6-4.el6_5.2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "piranha-0:0.8.6-4.el6_5.2.i686 as a component of Red Hat Enterprise Linux Load Balancer (v. 6)",
          "product_id": "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.i686"
        },
        "product_reference": "piranha-0:0.8.6-4.el6_5.2.i686",
        "relates_to_product_reference": "6Server-LoadBalancer-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "piranha-0:0.8.6-4.el6_5.2.src as a component of Red Hat Enterprise Linux Load Balancer (v. 6)",
          "product_id": "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.src"
        },
        "product_reference": "piranha-0:0.8.6-4.el6_5.2.src",
        "relates_to_product_reference": "6Server-LoadBalancer-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "piranha-0:0.8.6-4.el6_5.2.x86_64 as a component of Red Hat Enterprise Linux Load Balancer (v. 6)",
          "product_id": "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.x86_64"
        },
        "product_reference": "piranha-0:0.8.6-4.el6_5.2.x86_64",
        "relates_to_product_reference": "6Server-LoadBalancer-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.i686 as a component of Red Hat Enterprise Linux Load Balancer (v. 6)",
          "product_id": "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.i686"
        },
        "product_reference": "piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
        "relates_to_product_reference": "6Server-LoadBalancer-6.5.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64 as a component of Red Hat Enterprise Linux Load Balancer (v. 6)",
          "product_id": "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64"
        },
        "product_reference": "piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64",
        "relates_to_product_reference": "6Server-LoadBalancer-6.5.z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-6492",
      "discovery_date": "2013-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1043040"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "piranha: web UI authentication bypass using POST requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.i686",
          "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.src",
          "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.x86_64",
          "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
          "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6492"
        },
        {
          "category": "external",
          "summary": "RHBZ#1043040",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043040"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6492",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6492"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6492",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6492"
        }
      ],
      "release_date": "2013-12-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-02-13T18:45:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.i686",
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.src",
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.x86_64",
            "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
            "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0175"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.i686",
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.src",
            "6Server-LoadBalancer-6.5.z:piranha-0:0.8.6-4.el6_5.2.x86_64",
            "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.i686",
            "6Server-LoadBalancer-6.5.z:piranha-debuginfo-0:0.8.6-4.el6_5.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "piranha: web UI authentication bypass using POST requests"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.