Red Hat Security Advisory: Red Hat Network Satellite server security and enhancement update

Fixed packages 28

Vulnerabilities 5

• Medium 6.5
  CVE-2011-1594

  Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

  A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phis…

  Red Hat Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Network Satellite Server v 5.4 Linux
  Feb 5, 2014
• Medium 5.5
  CVE-2011-2920

  Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.

  A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. Thi…

  Red Hat Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Network Satellite Server v 5.4 Linux
  Feb 5, 2014
• Medium 5.4
  CVE-2011-2927

  Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms

  A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors r…

  Red Hat Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Network Satellite Server v 5.4 Linux
  Feb 5, 2014
• Medium 5.4
  CVE-2011-3344

  Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form

  A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions wi…

  Red Hat Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Network Satellite Server v 5.4 Linux
  Feb 5, 2014
• Unscored —
  CVE-2011-2919

  Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote at…

  Feb 5, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=672167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=681032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=713477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=713478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=730955
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=731647
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1299.json
• report
  https://access.redhat.com/security/cve/CVE-2011-1594
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-1594
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-1594
• report
  https://access.redhat.com/security/cve/CVE-2011-2919
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2919
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2919
• report
  https://access.redhat.com/security/cve/CVE-2011-2920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2920
• report
  https://access.redhat.com/security/cve/CVE-2011-2927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-2927
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-2927
• report
  https://access.redhat.com/security/cve/CVE-2011-3344
• advisory
  https://www.cve.org/CVERecord?id=CVE-2011-3344
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2011-3344