RHSA-2013:0544: Important: Subscription Asset Manager 1.2 update

Red Hat Subscription Asset Manager acts as a proxy for handlingsubscription information and software updates on client machines.It was discovered that Katello did not properly check user permissions whenhandling certain requests. An authenticated remote attacker could use thisflaw to download consumer certificates or change settings of other users'systems if they knew the target system's UUID. (CVE-2012-5603)It was found that the"/usr/share/katello/script/katello-generate-passphrase" utility, which isrun during the installation and configuration process, set world-readablepermissions on the "/etc/katello/secure/passphrase" file. A local attackercould use this flaw to obtain the passphrase for Katello, giving themaccess to information they would otherwise not have access to.(CVE-2012-5561)Note: After installing this update, ensure the"/etc/katello/secure/passphrase" file is owned by the root user and groupand mode 0750 permissions. Sites should also consider re-creating theKatello passphrase as this issue exposed it to local users.Three flaws were found in rubygem-rack. A remote attacker could use theseflaws to perform a denial of service attack against applications usingrubygem-rack. (CVE-2012-6109, CVE-2013-0183, CVE-2013-0184)It was found that rubyparser from rubygem-rubyparser created a temporaryfile in an insecure way. A local attacker could use this flaw to perform asymbolic link attack, overwriting arbitrary files accessible to theapplication using rubyparser. (CVE-2013-0162)The CVE-2012-5603 issue was discovered by Lukas Zapletal of Red Hat;CVE-2012-5561 was discovered by Aaron Weitekamp of the Red Hat CloudQuality Engineering team; and CVE-2013-0162 was discovered by MichaelScherer of the Red Hat Regional IT team.These updated Subscription Asset Manager packages include a number of bugfixes and enhancements. Space precludes documenting all of these changesin this advisory. Refer to the Red Hat Subscription Asset Manager 1.2Release Notes for information about these changes:https://access.redhat.com/knowledge/docs/en-US/RedHatSubscriptionAssetManager/1.2/html/ReleaseNotes/index.html All users of Red Hat Subscription Asset Manager are advised to upgrade tothese updated packages, which fix these issues and add variousenhancements.