CVE-2013-2056 vulnerability in Red Hat Products
Published on July 31, 2013
Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass
A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure.
Vulnerability Analysis
CVE-2013-2056 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2013-2056
stack.watch emails you whenever new vulnerabilities are published in Red Hat Satellite or Red Hat Network Satellite. Just hit a watch button to start following.
Affected Versions
Red Hat Network Satellite Server v 5.3:- Version 0:0.5.28-59.3.el5sat and below * is unaffected.
- Version 0:1.2.13-79.el5sat and below * is unaffected.
- Version 0:1.7.38-45.el5sat and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.