Red Hat Subscription Manager CVE-2012-6137 SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	59674
Class:	Design Error
CVE:	CVE-2012-6137
Remote:	Yes
Local:	No
Published:	May 06 2013 12:00AM
Updated:	Jun 14 2013 09:16AM
Credit:	Florian Weimer of the Red Hat Product Security Team
Vulnerable:	Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server
Not Vulnerable:

Red Hat Subscription Manager CVE-2012-6137 SSL Certificate Validation Security Bypass Vulnerability

Red Hat Subscription Manager is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.

An attacker can exploit this issue to perform man-in-the-middle attacks to obtain the user's Red Hat Network credentials, which will aid in further attacks.

Red Hat Subscription Manager CVE-2012-6137 SSL Certificate Validation Security Bypass Vulnerability

An attacker can exploit this issue using readily available tools.

Red Hat Subscription Manager CVE-2012-6137 SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat Subscription Manager CVE-2012-6137 SSL Certificate Validation Security Bypass Vulnerability

References:

• Red Hat Homepage (Red Hat)