Red Hat Network Satellite Server Security Bypass and Information Disclosure Vulnerabilities

Bugtraq ID:	47316
Class:	Unknown
CVE:	CVE-2009-0788 CVE-2010-1171
Remote:	Yes
Local:	No
Published:	Apr 11 2011 12:00AM
Updated:	Apr 11 2011 12:00AM
Credit:	Reported by vendor.
Vulnerable:	Red Hat Network Satellite Server (for RHEL 5) 5.4 Red Hat Network Satellite Server (for RHEL 5) 5.3 Red Hat Network Satellite Server (for RHEL 4) 5.3
Not Vulnerable:

Red Hat Network Satellite Server Security Bypass and Information Disclosure Vulnerabilities

Red Hat Network Satellite Server is prone to a security-bypass vulnerability and an information-disclosure vulnerability.

Attackers can exploit these issues to bypass security restrictions, obtain potentially sensitive information and may cause denial-of-service conditions; other attacks may also be possible.

Red Hat Network Satellite Server Security Bypass and Information Disclosure Vulnerabilities

An attacker can exploit this issue via readily available tools.

Red Hat Network Satellite Server Security Bypass and Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the reference for more information.

Red Hat Network Satellite Server Security Bypass and Information Disclosure Vulnerabilities

References:

• About RHN (Red Hat)
  
• CVE-2009-0788 rhn_satellite: Incorrect mod_rewrite rules (inform (Redhat)
  
• CVE-2010-1171 rhn_satellite: Improper channel comps information management (Red Hat)