CVE-2012-6137: Medium severity red hat enterprise linux vulnerability
A security flaw was found in the way rhn-migrate-classic-to-rhsm tool of subscription-manager, a suite of tools and libraries for subscription and repository management, performed migration of system profiles, registered with Red Hat Network Classic to Customer Portal Subscription Management (certificate of Red Hat Network Classic server was not verified for validity). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to their ability to obtain user credentials, that would be used for authentication of that particular user at Red Hat Network Classic server before the system profile(s) migration.
This issue was found by Florian Weimer of Red Hat Product Security Team.
Other sources
rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6137?
CVE-2012-6137 is rated as a moderate severity vulnerability.
How do I fix CVE-2012-6137?
To fix CVE-2012-6137, ensure you apply the latest updates provided by Red Hat for affected versions.
Which software is affected by CVE-2012-6137?
CVE-2012-6137 affects various versions of Red Hat Enterprise Linux, including 5 and 6 series.
What is the nature of the vulnerability in CVE-2012-6137?
CVE-2012-6137 is a security flaw in the rhn-migrate-classic-to-rhsm tool used for system profile migrations.
Is there a workaround for CVE-2012-6137?
Currently, there are no specific workarounds for CVE-2012-6137 other than upgrading to patched versions.