CVE-2015-7544
First published: Wed Oct 07 2015(Updated: )
Alexander Wels of Red Hat reported vulnerability allowing anybody possessing SuperUser role on any Entity to remotely execute arbitrary code as root on any host in RHEV environment. The vulnerability is in the feature that allows to view logs that reside on the hosts from inside the UI by selecting the log from the UI. It happens as following: /* http request to /redhat-support-plugin- rhev/logs?path=<path+filename>&machine=<name of machine selected>/ /* servlet handles the request, and passes the <path+filename> to an ssh client class./ /* The ssh client connects to the selected machine and executes as root/ / 'stat - c %s ' + <path+filename>/ Nowhere in this sequence is the <path+filename> checked or validated. The only validation that happens is that the session associated with the request has the 'SuperUser' role. It doesn't matter what entity the role is on, it just has to have that role on any entity in the RHEV system. With fairly simple url parameter manipulation, an arbitrary code can be executed as root on any host in the RHEV system. Note that SuperUser on an Entity != ROOT on the hosts.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Virtualization Manager | =3.4 | |
| Red Hat Enterprise Virtualization Manager | =3.4.1 | |
| Red Hat Enterprise Virtualization Manager | =3.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-7544?
CVE-2015-7544 is considered critical due to its ability to allow arbitrary code execution as root.
How do I fix CVE-2015-7544?
Fixing CVE-2015-7544 requires upgrading to the latest patched version of Red Hat Enterprise Virtualization Manager.
What versions are affected by CVE-2015-7544?
CVE-2015-7544 affects versions 3.4, 3.4.1, and 3.5.0 of Red Hat Enterprise Virtualization Manager.
Who reported CVE-2015-7544?
CVE-2015-7544 was reported by Alexander Wels of Red Hat.
What impact does CVE-2015-7544 have on systems?
CVE-2015-7544 allows unauthorized remote execution of code, which can compromise the entire RHEV environment.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-7544
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat enterprise virtualization manager
- version/red hat enterprise virtualization manager/3.4
- version/red hat enterprise virtualization manager/3.4.1
- version/red hat enterprise virtualization manager/3.5.0