SUSE WebYaST remotely accessible hosts list vulnerability

Overview

The WebYaST hosts list is remotely accessible by unauthenticated attackers. An attacker may be able to add a malicious host to the list and perform a man-in-the-middle attack against WebYaST.

Description

The SUSE security advisory states:

The hosts list used by WebYaST for connecting to it’s back end part was modifiable allowing to point to a malicious website which then could access all values sent by WebYaST. The /host configuration path was removed to fix this issue.

Additional details may be found in advisory SUSE-SU-2013:0053-1.

---

Impact

A remote unauthenticated attacker may be able to add a malicious server to the WebYaST hosts file and then be able to perform a man-in-the-middle attack against WebYaST.

---

Solution

Apply an Update

WebYaST patch slewyst12-webyast-base-ui-7236 has been released to address this vulnerability.

---

Restrict Access

Firewall rules to block untrusted networks and hosts from accessing TCP port 4984 should be implemented.

---

Vendor Information

806908

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Novell, Inc. Affected

Notified: November 28, 2012 Updated: January 25, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

SUSE Linux Affected

Updated: January 25, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N
Temporal	5	E:POC/RL:OF/RC:C
Environmental	4.9	CDP:LM/TD:M/CR:M/IR:M/AR:L

References

• <http://support.novell.com/security/cve/CVE-2012-0435.html&gt;
• <http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00008.html&gt;

Acknowledgements

Thanks to Tenable Network Security for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2012-0435
Date Public:	2013-01-23 Date First Published: