CVE-2012-3503: Critical severity Katello Katello vulnerability
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secrettoken.
Other sources
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secrettoken value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secrettoken.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3503?
CVE-2012-3503 is classified with a medium severity level due to its potential to allow unauthorized access.
How do I fix CVE-2012-3503?
To fix CVE-2012-3503, upgrade to Katello version 1.1.7 or later, or upgrade to version 1.0.6 or later if staying on the 1.0 branch.
What are the consequences of CVE-2012-3503?
Exploitation of CVE-2012-3503 can allow remote attackers to authenticate as any user to the CloudForms System Engine interface.
Which versions of Katello are affected by CVE-2012-3503?
CVE-2012-3503 affects Katello versions 1.0 and earlier.
Is CVE-2012-3503 a vulnerability in Red Hat Enterprise Linux?
Yes, CVE-2012-3503 can impact systems running Red Hat Enterprise Linux Server 6.0 if they have an affected version of Katello installed.