Security update for SUSE Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1347-1 Final 1 1 2017-05-18T22:19:15Z current 2017-05-18T22:19:15Z 2017-05-18T22:19:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Client Tools The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470) Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib. (bsc#1025312) spacecmd: - Improve output on error for listrepo. (bsc#1027426) - Reword spacecmd removal message. (bsc#1024406) spacewalk-backend: - Do not fail with traceback when media.1 does not exist. (bsc#1032256) - Create scap files directory beforehand. (bsc#1029755) - Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not present. - Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233) - Add support for running spacewalk-debug without creating reports. (bsc#1024714) - Set scap store directory mod to 775 and group owner to susemanager. - incomplete_package_import: Do import rhnPackageFile as it breaks some package installations. - Added traceback printing to the exception block. - Change postgresql starting commands. spacewalk-client-tools: - Fix reboot message to use correct product name. (bsc#1031667) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slesctsp3-client-tools-201704-13115,slesctsp4-client-tools-201704-13115 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171347-1/ Link for SUSE-SU-2017:1347-1 https://lists.suse.com/pipermail/sle-security-updates/2017-May/002898.html E-Mail link for SUSE-SU-2017:1347-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1023233 SUSE Bug 1023233 https://bugzilla.suse.com/1024406 SUSE Bug 1024406 https://bugzilla.suse.com/1024714 SUSE Bug 1024714 https://bugzilla.suse.com/1025312 SUSE Bug 1025312 https://bugzilla.suse.com/1026633 SUSE Bug 1026633 https://bugzilla.suse.com/1027426 SUSE Bug 1027426 https://bugzilla.suse.com/1029755 SUSE Bug 1029755 https://bugzilla.suse.com/1031667 SUSE Bug 1031667 https://bugzilla.suse.com/1032256 SUSE Bug 1032256 https://www.suse.com/security/cve/CVE-2017-7470/ SUSE CVE CVE-2017-7470 page SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS rhnlib-2.5.84.4-8.1 spacecmd-2.5.5.5-14.1 spacewalk-backend-libs-2.5.24.9-24.1 spacewalk-check-2.5.13.8-23.1 spacewalk-client-setup-2.5.13.8-23.1 spacewalk-client-tools-2.5.13.8-23.1 rhnlib-2.5.84.4-8.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacecmd-2.5.5.5-14.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-backend-libs-2.5.24.9-24.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-check-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-client-setup-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS spacewalk-client-tools-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS rhnlib-2.5.84.4-8.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacecmd-2.5.5.5-14.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-backend-libs-2.5.24.9-24.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-check-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-client-setup-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS spacewalk-client-tools-2.5.13.8-23.1 as a component of SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py. CVE-2017-7470 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:rhnlib-2.5.84.4-8.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacecmd-2.5.5.5-14.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-backend-libs-2.5.24.9-24.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-check-2.5.13.8-23.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-setup-2.5.13.8-23.1 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS:spacewalk-client-tools-2.5.13.8-23.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:rhnlib-2.5.84.4-8.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacecmd-2.5.5.5-14.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-backend-libs-2.5.24.9-24.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-check-2.5.13.8-23.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-setup-2.5.13.8-23.1 SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS:spacewalk-client-tools-2.5.13.8-23.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171347-1/ https://www.suse.com/security/cve/CVE-2017-7470.html CVE-2017-7470 https://bugzilla.suse.com/1026633 SUSE Bug 1026633 https://bugzilla.suse.com/1057882 SUSE Bug 1057882