rhsa-2012:0477
Vulnerability from csaf_redhat
Published
2012-04-12 16:26
Modified
2024-11-22 05:14
Summary
Red Hat Security Advisory: Red Hat Enterprise MRG Management Console security update

Notes

Topic
An updated MRG Management Console package that fixes several security issues is now available for Red Hat Enterprise MRG 2 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. Several cross-site scripting (XSS) flaws were found in the MRG Management Console (Cumin). An authorized user on the local network could use these flaws to perform cross-site scripting attacks against MRG Management Console users. Note: Refer to the MRG Messaging User Guide for information on configuring authentication and authorization in the MRG Messaging broker. (CVE-2012-1575) Users of Red Hat Enterprise MRG Management Console are advised to upgrade to this updated package, which corrects these issues. The MRG Management Console must be restarted ("service cumin restart") for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated MRG Management Console package that fixes several security\nissues is now available for Red Hat Enterprise MRG 2 for Red Hat\nEnterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation\nIT infrastructure for enterprise computing. MRG offers increased\nperformance, reliability, interoperability, and faster computing for\nenterprise customers.\n\nSeveral cross-site scripting (XSS) flaws were found in the MRG Management\nConsole (Cumin). An authorized user on the local network could use these\nflaws to perform cross-site scripting attacks against MRG Management\nConsole users. Note: Refer to the MRG Messaging User Guide for information\non configuring authentication and authorization in the MRG Messaging\nbroker. (CVE-2012-1575)\n\nUsers of Red Hat Enterprise MRG Management Console are advised to upgrade\nto this updated package, which corrects these issues. The MRG Management\nConsole must be restarted (\"service cumin restart\") for this update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:0477",
        "url": "https://access.redhat.com/errata/RHSA-2012:0477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/docs/en-US/index.html",
        "url": "https://docs.redhat.com/docs/en-US/index.html"
      },
      {
        "category": "external",
        "summary": "805712",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=805712"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0477.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Enterprise MRG Management Console security update",
    "tracking": {
      "current_release_date": "2024-11-22T05:14:41+00:00",
      "generator": {
        "date": "2024-11-22T05:14:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2012:0477",
      "initial_release_date": "2012-04-12T16:26:00+00:00",
      "revision_history": [
        {
          "date": "2012-04-12T16:26:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-04-12T16:35:19+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T05:14:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat MRG Grid for RHEL 6 Server v.2",
                "product": {
                  "name": "Red Hat MRG Grid for RHEL 6 Server v.2",
                  "product_id": "6Server-MRG-Grid-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat MRG Management for RHEL 6 Server v.2",
                "product": {
                  "name": "Red Hat MRG Management for RHEL 6 Server v.2",
                  "product_id": "6Server-MRG-Management-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise MRG for RHEL-6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cumin-0:0.1.5192-5.el6.noarch",
                "product": {
                  "name": "cumin-0:0.1.5192-5.el6.noarch",
                  "product_id": "cumin-0:0.1.5192-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cumin@0.1.5192-5.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cumin-0:0.1.5192-5.el6.src",
                "product": {
                  "name": "cumin-0:0.1.5192-5.el6.src",
                  "product_id": "cumin-0:0.1.5192-5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cumin@0.1.5192-5.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cumin-0:0.1.5192-5.el6.noarch as a component of Red Hat MRG Grid for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.noarch"
        },
        "product_reference": "cumin-0:0.1.5192-5.el6.noarch",
        "relates_to_product_reference": "6Server-MRG-Grid-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cumin-0:0.1.5192-5.el6.src as a component of Red Hat MRG Grid for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.src"
        },
        "product_reference": "cumin-0:0.1.5192-5.el6.src",
        "relates_to_product_reference": "6Server-MRG-Grid-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cumin-0:0.1.5192-5.el6.noarch as a component of Red Hat MRG Management for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.noarch"
        },
        "product_reference": "cumin-0:0.1.5192-5.el6.noarch",
        "relates_to_product_reference": "6Server-MRG-Management-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cumin-0:0.1.5192-5.el6.src as a component of Red Hat MRG Management for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.src"
        },
        "product_reference": "cumin-0:0.1.5192-5.el6.src",
        "relates_to_product_reference": "6Server-MRG-Management-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-1575",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2012-03-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "805712"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cumin: multiple XSS flaws",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.noarch",
          "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.src",
          "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.noarch",
          "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-1575"
        },
        {
          "category": "external",
          "summary": "RHBZ#805712",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=805712"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1575",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-1575"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1575",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1575"
        }
      ],
      "release_date": "2012-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-04-12T16:26:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.noarch",
            "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.src",
            "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.noarch",
            "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:0477"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.noarch",
            "6Server-MRG-Grid-2:cumin-0:0.1.5192-5.el6.src",
            "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.noarch",
            "6Server-MRG-Management-2:cumin-0:0.1.5192-5.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cumin: multiple XSS flaws"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.