RHSA-2013:0686: Moderate: Subscription Asset Manager 1.2.1 update

Red Hat Subscription Asset Manager acts as a proxy for handlingsubscription information and software updates on client machines.The latest packages for Subscription Asset Manager include a number of securityfixes:When a Subscription Asset Manager instance is created, its configurationscript automatically creates an RPM of the internal subscription service CA certificate. However, this RPM incorrectly created the CA certificatewith file permissions of 0666. This allowed other users on a client systemto modify the CA certificate used to trust the remote subscription server.All administrators are advised to update and deploy the subscriptionservice certificate on all systems which use Subscription Asset Manageras their subscription service. This procedure is described in:https://access.redhat.com/knowledge/docs/en-US/RedHatSubscriptionAssetManager/1.2/html/InstallationGuide/sect-InstallationGuide-Administration-UpgradingSubscriptionAssetManager.html (CVE-2012-6116)Manifest signature checking was not implemented for early versions of Subscription Asset Manager. This meant that a malicious user could edita manifest file, insert arbitrary data, and successfully upload the editedmanifest file into the Subscription Asset Manager server. (CVE-2012-6119)Ruby's documentation generator had a flaw in the way it generated HTMLdocumentation. When a Ruby application exposed its documentationon a network (such as a web page), an attacker could use a specially-crafted URL to open an arbitrary web script or to execute HTML codewithin the application's user session. (CVE-2013-0256)A timing attack flaw was found in the way rubygem-rack andruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aidan attacker using forged digital signatures to bypass authenticationchecks. (CVE-2013-0263)A flaw in rubygem-json allowed remote attacks by creating different typesof malicious objects. For example, it could initiate a denial of service(DoS) attack through resource consumption by using a JSON document tocreate arbitrary Ruby symbols, which were never garbage collected. Itcould also be exploited to create internal objects which could allow a SQLinjection attack. (CVE-2013-0269)A flaw in ActiveRecord in Ruby on Rails allowed remote attackers tocircumvent attribute protections and to insert their own crafted requeststo change protected attribute values. (CVE-2013-0276)HTML markup was not properly escaped when filling in the username field inthe Notifications form of the Subscription Asset Manager UI. This meantthat HTML code used in the value was then applied in the UI page when theentry was viewed. This could have allowed malicious HTML code to beentered. The field value is now validated and any HTML tags are escaped.(CVE-2013-1823)These updated packages also include bug fixes and enhancements: Previously, no SELinux policy for the subscription service was included with the Subscription Asset Manager packages. The candlepin-selinux packageis now included with SELinux policies for the subscription server. (BZ#906901) When attempting to use the subscription service's CA certificate to validate a manifest during import, the comparison failed. The upstreamsubscription service which generated the manifest is a different servicethan the local subscription service; thus, they have different CAcertificates. This caused importing a manifest to fail with the error'archive failed signature'. This has been fixed so that the propercertificate is used for verification. (BZ#918778)All users of Subscription Asset Manager are recommended to update to thelatest packages.