CVE-2012-0860: Medium severity red hat enterprise virtualization manager vulnerability
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vdsbootstrap.py Python module in /tmp/.
Other sources
When installing new host, RHEV-M connects to the host via ssh as root and copies vdsinstaller.py script into /tmp. vdsinstaller downloads deployUtil.py and vdsbootstrap.py via curl.
If we look into python docs [1], it clearly outlines the module search path. The first bullet says that:
"the directory containing the input script (or the current directory)."
is searched when the module to be imported is not built-in. In our case both the directory containing the input script and current directory is /tmp.
[1] http://docs.python.org/tutorial/modules.html#the-module-search-path
To exploit the flaw you just need to create any of the imported modules in /tmp and it gets run as root upon host installation.
Other exploit might be to pre-create /tmp/deployUtil.py, wait for vor vdsinstaller to download it from RHEV-M and then change the content before it's imported/executed.
Either way, copying and running python scripts from /tmp is really bad idea. Use private directory in /tmp for scripts and logs.
vdsinstaller also creates log files with semi-random names which are prone to symlink attacks.
A local, unprivileged user on the host to be installed/addedd to RHEV-M could use this flaw to escalate their privileges.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0860?
CVE-2012-0860 has a high severity rating due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2012-0860?
To fix CVE-2012-0860, upgrade Red Hat Enterprise Virtualization Manager to version 3.1 or later.
What versions of Red Hat Enterprise Virtualization Manager are affected by CVE-2012-0860?
Versions before 3.1, as well as versions 2.1, 2.2, and 2.2.3 of Red Hat Enterprise Virtualization Manager, are affected by CVE-2012-0860.
What type of vulnerability is CVE-2012-0860?
CVE-2012-0860 is characterized as an untrusted search path vulnerability in the Red Hat Enterprise Virtualization Manager.
Can CVE-2012-0860 be exploited remotely?
No, CVE-2012-0860 requires local access to the system for exploitation.