RHSA-2011:0394: Important: conga security update
The conga packages provide a web-based administration tool for remotecluster and storage management.A privilege escalation flaw was found in luci, the Conga web-basedadministration application. A remote attacker could possibly use this flawto obtain administrative access, allowing them to read, create, or modifythe content of the luci application. (CVE-2011-0720)Users of Conga are advised to upgrade to these updated packages, whichcontain a backported patch to resolve this issue. After installing theupdated packages, luci must be restarted ("service luci restart") for theupdate to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0394?
The severity of RHSA-2011:0394 is classified as important.
How do I fix RHSA-2011:0394?
To fix RHSA-2011:0394, update the conga, luci, and ricci packages to version 0.12.2-24.el5_6.1.
What is the primary vulnerability in RHSA-2011:0394?
The primary vulnerability in RHSA-2011:0394 is a privilege escalation flaw in the luci web-based administration application.
Which systems are affected by RHSA-2011:0394?
Systems running the conga, luci, and ricci packages prior to version 0.12.2-24.el5_6.1 are affected by RHSA-2011:0394.
What can attackers do by exploiting RHSA-2011:0394?
By exploiting RHSA-2011:0394, attackers could potentially obtain administrative access to the system.