CVE-2016-6338: Medium severity red hat enterprise virtualization vulnerability
Greg Sheremeta of Red Hat reports:
We've found a scenario a webadmin session won't timeout and force a logout. We had a CVE on this before.
To duplicate: navigate to the Data Centers tab. Select a data center. Switch to another browser tab and wait longer than the engine timeout period [1] to switch back to webadmin. You won't be logged out -- even though you should be.
Basically, idling while certain things in the UI are selected (a data center, a cluster -- maybe others?) will prevent the session from timing out. We see three gluster queries that are repeating and keeping the session open. Alexander is looking for others. We know the fix -- just have to find them all.
Other sources
ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6338?
CVE-2016-6338 has been assigned a severity rating that indicates potential risks due to session management failure.
How do I fix CVE-2016-6338?
To fix CVE-2016-6338, update your Red Hat Enterprise Virtualization to the latest security patch provided by Red Hat.
What software is affected by CVE-2016-6338?
CVE-2016-6338 affects Red Hat Enterprise Virtualization version 4.0.
Can CVE-2016-6338 lead to unauthorized access?
Yes, CVE-2016-6338 can potentially allow unauthorized access if an admin session does not timeout properly.
What is the potential impact of exploiting CVE-2016-6338?
Exploitation of CVE-2016-6338 could result in prolonged access to webadmin sessions, posing security risks.