Red Hat Subscription Asset Manager Weak Authentication Security Bypass Vulnerability

Bugtraq ID:	64515
Class:	Design Error
CVE:	CVE-2013-6439
Remote:	Yes
Local:	No
Published:	Dec 19 2013 12:00AM
Updated:	Dec 19 2013 12:00AM
Credit:	Adrian Likins of RedHat
Vulnerable:	Redhat Subscription Asset Manager 1.3 Redhat Subscription Asset Manager 1.2.1 Redhat Subscription Asset Manager 1.2.0 Redhat Subscription Asset Manager 1.1.0 Redhat Subscription Asset Manager 1.0.0
Not Vulnerable:

Red Hat Subscription Asset Manager Weak Authentication Security Bypass Vulnerability

Red Hat Subscription Asset Manager is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Red Hat Subscription Asset Manager 1.0 through 1.3 are vulnerable.

Red Hat Subscription Asset Manager Weak Authentication Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Red Hat Subscription Asset Manager Weak Authentication Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat Subscription Asset Manager Weak Authentication Security Bypass Vulnerability

References:

• Red Hat Subscription Asset Manager (Red Hat)
  
• RHSA-2013:1863-1: Important: candlepin security update (Red Hat)