1. CVE-Search
  2. CVE-2012-6137
ID CVE-2012-6137
Summary rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.
References
Vulnerable Configurations
  • cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:client:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:client:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:5.9.z:*:server:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:5.9.z:*:server:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_long_life:5.9:*:server:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_long_life:5.9:*:server:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:6.4.z:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:6.4.z:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 29-08-2017 - 01:32)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
redhat via4
advisories
bugzilla
id 885130
title CVE-2012-6137 subscription-manager: rhn-migrate-classic-to-rhsm missing SSL certificate verification
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • comment subscription-manager is earlier than 0:1.0.24.1-1.el5_9
          oval oval:com.redhat.rhsa:tst:20130788001
        • comment subscription-manager is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130788002
      • AND
        • comment subscription-manager-firstboot is earlier than 0:1.0.24.1-1.el5_9
          oval oval:com.redhat.rhsa:tst:20130788003
        • comment subscription-manager-firstboot is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130788004
      • AND
        • comment subscription-manager-gui is earlier than 0:1.0.24.1-1.el5_9
          oval oval:com.redhat.rhsa:tst:20130788005
        • comment subscription-manager-gui is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130788006
      • AND
        • comment subscription-manager-migration is earlier than 0:1.0.24.1-1.el5_9
          oval oval:com.redhat.rhsa:tst:20130788007
        • comment subscription-manager-migration is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20130788008
  • AND
    • comment Red Hat Enterprise Linux 6 is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • comment subscription-manager is earlier than 0:1.1.23.1-1.el6_4
          oval oval:com.redhat.rhsa:tst:20130788010
        • comment subscription-manager is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20130788011
      • AND
        • comment subscription-manager-firstboot is earlier than 0:1.1.23.1-1.el6_4
          oval oval:com.redhat.rhsa:tst:20130788012
        • comment subscription-manager-firstboot is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20130788013
      • AND
        • comment subscription-manager-gui is earlier than 0:1.1.23.1-1.el6_4
          oval oval:com.redhat.rhsa:tst:20130788014
        • comment subscription-manager-gui is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20130788015
      • AND
        • comment subscription-manager-migration is earlier than 0:1.1.23.1-1.el6_4
          oval oval:com.redhat.rhsa:tst:20130788016
        • comment subscription-manager-migration is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20130788017
rhsa
id RHSA-2013:0788
released 2013-05-06
severity Moderate
title RHSA-2013:0788: subscription-manager security update (Moderate)
rpms
  • subscription-manager-0:1.0.24.1-1.el5_9
  • subscription-manager-0:1.1.23.1-1.el6_4
  • subscription-manager-debuginfo-0:1.0.24.1-1.el5_9
  • subscription-manager-debuginfo-0:1.1.23.1-1.el6_4
  • subscription-manager-firstboot-0:1.0.24.1-1.el5_9
  • subscription-manager-firstboot-0:1.1.23.1-1.el6_4
  • subscription-manager-gui-0:1.0.24.1-1.el5_9
  • subscription-manager-gui-0:1.1.23.1-1.el6_4
  • subscription-manager-migration-0:1.0.24.1-1.el5_9
  • subscription-manager-migration-0:1.1.23.1-1.el6_4
refmap via4
bid 59674
confirm https://bugzilla.redhat.com/show_bug.cgi?id=885130
osvdb 93058
sectrack 1028520
secunia 53330
xf redhat-ssl-cve20126137-sec-bypass(84020)
Last major update 29-08-2017 - 01:32
Published 21-05-2013 - 18:55
Last modified 29-08-2017 - 01:32
Back to Top