CVE-2009-4139: CSRF
First published: Sat Oct 17 2009(Updated: )
Cross-site request forgery (CSRF) vulnerability in the Spacewalk Java site packages (aka spacewalk-java) 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that (1) disable the current user account, (2) add user accounts, or (3) modify user accounts to have administrator privileges.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Satellite | =5.3.0 | |
| Red Hat Satellite | =5.4.0 | |
| Red Hat Satellite | =5.4.1 | |
| Red Hat Spacewalk | =1.2.39 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.redhat.com/support/errata/RHSA-2011-0879.html
- http://securitytracker.com/id?1025674
- https://bugzilla.redhat.com/show_bug.cgi?id=529483
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68074
- https://rhn.redhat.com/errata/RHSA-2011-0879.html
- https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=86afbf7c8bec544f44c9e9a65fad453422389cfe
Frequently Asked Questions
What is the severity of CVE-2009-4139?
CVE-2009-4139 is considered a moderate severity vulnerability due to its potential for CSRF attacks that can hijack user authentication.
How do I fix CVE-2009-4139?
To fix CVE-2009-4139, upgrade to a version of Red Hat Network Satellite or Spacewalk that has mitigated this vulnerability, such as 5.4.2 or later.
What types of systems are affected by CVE-2009-4139?
CVE-2009-4139 affects Red Hat Network Satellite Server versions 5.3.0 to 5.4.1 and Spacewalk Java version 1.2.39.
What exploits are possible due to CVE-2009-4139?
Exploiting CVE-2009-4139 could allow an attacker to perform unauthorized actions on behalf of authenticated users.
Is there a way to mitigate the risk of CVE-2009-4139 if I cannot update immediately?
To mitigate the risk of CVE-2009-4139, consider implementing additional CSRF protections such as requiring tokens for sensitive requests.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-4139
- agent/trending
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.3.0
- version/red hat satellite/5.4.0
- version/red hat satellite/5.4.1
- canonical/red hat spacewalk
- version/red hat spacewalk/1.2.39