CVE-2012-0861

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-0861
The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 3.2 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2012-1505.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1506.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-1508.html Vendor Advisory
http://www.securityfocus.com/bid/56825
http://www.securitytracker.com/id?1027838
https://exchange.xforce.ibmcloud.com/vulnerabilities/80544
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:enterprise_virtualization_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_virtualization_manager:2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2.3:*:*:*:*:*:*:*
History

13 Feb 2023, 00:23

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2012:1506', 'name': 'https://access.redhat.com/errata/RHSA-2012:1506', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2012:1508', 'name': 'https://access.redhat.com/errata/RHSA-2012:1508', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2012:1505', 'name': 'https://access.redhat.com/errata/RHSA-2012:1505', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=790754', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=790754', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2012-0861', 'name': 'https://access.redhat.com/security/cve/CVE-2012-0861', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2012-0861 rhev: vds_installer is prone to MITM when downloading 2nd stage installer The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

02 Feb 2023, 18:15

Type Values Removed Values Added
Summary The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack. CVE-2012-0861 rhev: vds_installer is prone to MITM when downloading 2nd stage installer
References
  • (MISC) https://access.redhat.com/errata/RHSA-2012:1506 -
  • (MISC) https://access.redhat.com/errata/RHSA-2012:1508 -
  • (MISC) https://access.redhat.com/errata/RHSA-2012:1505 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=790754 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2012-0861 -
Information

Published : 2013-01-04 22:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-0861

Mitre link : CVE-2012-0861

CVE.ORG link : CVE-2012-0861

JSON object : View

Products Affected

redhat

  • enterprise_virtualization_manager
CWE
CWE-310

Cryptographic Issues