oVirt Engine DWH CVE-2015-0257 Local Security Bypass Vulnerability

Bugtraq ID:	74394
Class:	Design Error
CVE:	CVE-2015-0257
Remote:	No
Local:	Yes
Published:	Apr 01 2015 12:00AM
Updated:	Apr 01 2015 12:00AM
Credit:	Yedidyah Bar David of the Red Hat.
Vulnerable:	Redhat Enterprise Virtualization Manager 3.5 oVirt oVirt Engine DWH 0
Not Vulnerable:	Redhat Enterprise Virtualization Manager 3.5.1

oVirt Engine DWH CVE-2015-0257 Local Security Bypass Vulnerability

oVirt Engine DWH is prone to a local security-bypass vulnerability.

Local attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

oVirt Engine DWH CVE-2015-0257 Local Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

oVirt Engine DWH CVE-2015-0257 Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

oVirt Engine DWH CVE-2015-0257 Local Security Bypass Vulnerability

References:

• oVirt Engine DWH Homepage (oVirt)
  
• ovirt-engine-dwh: incorrect permissions on plugin file containing passwords (Red Hat)
  
• Security Advisory Moderate: Red Hat Enterprise Virtualization Manager 3.5.1 upda (Redhat)