CVE-2012-0861

Insecure SSL validation in RHEV-M vds_installer (pre-3.1) allows remote code execution via MITM

• CVSS 6.8
• CWE-310
• Cryptographic
• Remote

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

CVE

CVE-2012-0861

CWE

CWE-310

CVSS base score

6.8

Published

2013-01-04

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update RHEV-M to version 3.1 or higher.

import os

def download_file(url, destination):
    os.system(f"curl -k -o {destination} {url}")

download_file('https://example.com/deployUtil.py', 'deployUtil.py')
download_file('https://example.com/vds_bootstrap.py', 'vds_bootstrap.py')

import requests

def download_file(url, destination):
    response = requests.get(url)

    if response.status_code == 200:
        with open(destination, 'wb') as f:
            f.write(response.content)
    else:
        raise ValueError(f"Failed to download file from {url}")

download_file('https://example.com/deployUtil.py', 'deployUtil.py')
download_file('https://example.com/vds_bootstrap.py', 'vds_bootstrap.py')

@misc{vaitp:cve20120861,
  title        = {{Insecure SSL validation in RHEV-M vds_installer (pre-3.1) allows remote code execution via MITM}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-0861},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-0861/}}
}