Vulnerabilities > CVE-2014-0199 - Cryptographic Issues vulnerability in Redhat Rhevm-Reports

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2014:0558. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(79022);
  script_version("1.12");
  script_cvs_date("Date: 2019/10/24 15:35:38");

  script_cve_id("CVE-2014-0199", "CVE-2014-0200", "CVE-2014-0201");
  script_bugtraq_id(67682, 67684);
  script_xref(name:"RHSA", value:"2014:0558");

  script_name(english:"RHEL 6 : rhevm-reports 3.3.3 (RHSA-2014:0558)");
  script_summary(english:"Checks the rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An updated rhevm-reports package that fixes three security issues and
one bug is now available.

The Red Hat Security Response Team has rated this update as having Low
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

The Red Hat Enterprise Virtualization reports package provides a suite
of pre-configured reports and dashboards that enable you to monitor
the system. The reports module is based on JasperReports and
JasperServer, and can also be used to create ad-hoc reports.

It was found that the ovirt-engine-reports setup script logged the
reports database password in plain text to a world-readable file. An
attacker with a local user account on the Red Hat Enterprise
Virtualization Manager server could use this flaw to access, read, and
modify the reports database. (CVE-2014-0199)

Note: Applying the update provided by this advisory does not modify
any existing log files. It is recommended that you search your
existing log files and remove any occurrences of plain text passwords
manually.

It was found that the Red Hat Enterprise Virtualization Manager
reports datasource configuration file (js-jboss7-ds.xml) was
world-readable. An attacker with a local user account on the Red Hat
Enterprise Virtualization Manager server could use this flaw to
access, read, and modify the reports database. (CVE-2014-0200)

It was found that multiple ovirt-engine-reports configuration files
were world-readable. An attacker with a local user account on the Red
Hat Enterprise Virtualization Manager server could use this flaw to
access a variety of potentially sensitive information. (CVE-2014-0201)

These issues were discovered by Red Hat.

This update also fixes the following bug :

* Previously, rhevm-reports-setup failed if the default spacing of the
pg_hba.conf file was manually modified. Now, the command does not
check exact spacing in the file, and setup completes successfully.
(BZ#1085374)

All rhevm-reports users are advised to upgrade to this updated
package, which corrects these issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2014:0558"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2014-0200"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2014-0199"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2014-0201"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected rhevm-reports package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rhevm-reports");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/05/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/11/08");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2014:0558";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_exists(rpm:"rhevm-reports-3.3.", release:"RHEL6") && rpm_check(release:"RHEL6", reference:"rhevm-reports-3.3.3-1.el6ev")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rhevm-reports");
  }
}