Red Hat Enterprise Virtualization Manager SSL Certificate Verification Security Bypass Vulnerability

Bugtraq ID:	42639
Class:	Design Error
CVE:	CVE-2009-3552
Remote:	No
Local:	Yes
Published:	Oct 14 2009 12:00AM
Updated:	Oct 14 2009 12:00AM
Credit:	Yaniv Kaul
Vulnerable:	Redhat Enterprise Virtualization Manager 2.2 Redhat Enterprise Virtualization Manager 0
Not Vulnerable:	Redhat Enterprise Virtualization Manager 2.2.2

Red Hat Enterprise Virtualization Manager SSL Certificate Verification Security Bypass Vulnerability

Red Hat Enterprise Virtualization Manager is prone to a security-bypass vulnerability.

Successfully exploiting this issue will allow attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to Red Hat Enterprise Virtualization Manager 2.2.2 are vulnerable.

Red Hat Enterprise Virtualization Manager SSL Certificate Verification Security Bypass Vulnerability

Attackers can exploit this issue with readily available tools.

Red Hat Enterprise Virtualization Manager SSL Certificate Verification Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Red Hat Enterprise Virtualization Manager SSL Certificate Verification Security Bypass Vulnerability

References:

• Bug 528890 - (CVE-2009-3552) RHEV-M VDC - GUI: Man in the middle attack possible (Red Hat)
  
• Moderate: Red Hat Enterprise Virtualization Manager security update (Red Hat)
  
• Red Hat Enterprise Virtualization Manager Homepage (Red Hat)