CVE-2010-1171

Vulnerability

Red Hat Network (RHN) Satellite versions 5.3 and 5.4 expose a dangerous, obsolete XML-RPC API used for configuring package group (comps.xml) files for channels. An attacker with a valid satellite account can leverage this API to access arbitrary files on the server and cause denial of service for clients using yum. The API should have been removed or restricted but was left accessible.

Exploitation

An authenticated user can call the obsolete XML-RPC API methods to read any file accessible to the Satellite server process. The attacker does not need special privileges beyond a valid account on the RHN Satellite. By crafting requests to the API, they can retrieve sensitive files from the server filesystem. Additionally, manipulation of comps.xml files can cause yum operations to fail for channel subscribers.

Impact

Successful exploitation allows an attacker to read arbitrary files on the RHN Satellite server, potentially exposing credentials, configuration data, or other sensitive information. Furthermore, the attacker can cause a denial of service by breaking yum operations, preventing clients from installing or updating packages through the affected channels.

Mitigation

Red Hat released RHSA-2011:0434 on 2011-04-12 to address this issue [1]. Affected sites should upgrade to the fixed versions of RHN Satellite. No workaround is available beyond applying the update. The vulnerability is also tracked in Red Hat Bugzilla as bug 584118 [2].