Kurt Seifried of Red Hat Product Security reports:

======================================== ./lib/util/MiqSshUtilV1.rb def shellexec(cmd, doneStr=nil, shell=@shell) if shell # Writing to a temp remote script to handle cases where the cmd string is # too long and is truncated. tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}") out = shell.sendcommand(tempremotescript) self.exec("rm -f #{tempremotescript}") @status = out.status msg = out.stdout

# Check if the first output return references the remote script and remove it. msgs = msg.split("\n") msg = msgs[1..-1].join("\n") if msgs[0].include?(tempremotescript)

raise "#{msg}" unless doneStr.nil? || msg.include?(doneStr) return msg else return self.exec(cmd, doneStr) end end ======================================== ./lib/util/MiqSshUtilV2.rb def tempcmdfile(cmd) tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") remotecmd = "chmod 700 #{tempremotescript}; #{tempremotescript}; rm -f #{tempremotescript}" yield(remotecmd) end ======================================== Time.now.toi = 1412123123 setup a file and a few hundred/thousand symlinks and you can cover an hour easily.

Between the

self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}")

an attacker can replace the file, which is then executed as root.

It should use Ruby Tempfile: http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

The waitfortask function in app/controllers/applicationcontroller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

Cross-site scripting (XSS) vulnerability in application/panelcontrol in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.