Security update for SUSE Manager Server 1.7

SUSE Security Update: Security update for SUSE Manager Server 1.7
Announcement ID: SUSE-SU-2015:0928-1
Rating: important
References: #799068 #809927 #814954 #864246 #870159 #879904 #881111 #896238 #896244 #898426 #900956 #901108 #902915 #903723 #906850 #912886 #922525
Affected Products:
  • SUSE Manager 1.7 for SLE 11 SP2
    		•

    An update that solves three vulnerabilities and has 14 fixes is now available. It includes 9 new package versions.

    Description:

    This collective update for SUSE Manager 1.7 provides several fixes and enhancements.

    smdba:

    • Space reclamation caused ORA-00942 (table or view does not exist). (bsc#906850)
    • Optimized space reclamation for Oracle.
    • Implement fully hot operations for PostgreSQL.
    • System check breaks backup and other configuration.
    • Implement rotating PostgreSQL backup feature. (bsc#896244)
    • Set PostgreSQL max connections to the same value as for Oracle.

    sm-ncc-sync-data:

    • Add ATI and nVidia channels for SLED11-SP3. (bsc#901108)

    spacecmd:

    • Fix call to setCustomOptions(). (bsc#879904)

    spacewalk-backend:

    • Fix encoding of submit message.
    • Trigger generation of metadata if the repository contains no packages. (bsc#870159)

    spacewalk-branding:

    • Update default Spacewalk entitlement certificate.

    spacewalk-java:

    • Introduce improved parser for xmlrpc. (CVE-2014-8162, bsc#922525)
    • Fix more cross-site scripting bugs. (CVE-2014-7811, bsc#902915)
    • Ffix CVE audit in case of multiversion package installed and patch in multi channels. (bsc#903723)
    • Fix automatic configuration file deployment via snippet. (bsc#898426)
    • Download CSV button does not export all columns ("Base Channel" missing). (bsc#896238)
    • Fix cross-site scripting in system-group. (CVE-2014-7812, bsc#912886)

    spacewalk-setup:

    • Fix XML RPC API External Entities file disclosure. (CVE-2014-8162, bsc#922525)
    • No activation if db population should be skipped. (bsc#900956)

    susemanager-schema:

    • Fix evr_t schema upgrade. (bsc#881111)

    susemanager:

    • Add tool to update the spacewalk public cert in the DB.
    • Fix the test for the mirror credentials. (bsc#864246)

    How to apply this update:

    1. Log in as root user to the SUSE Manager server.
2. Stop the Spacewalk service: spacewalk-service stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Upgrade the database schema with spacewalk-schema-upgrade
5. Start the Spacewalk service: spacewalk-service start

    Security Issues:

    Special Instructions and Notes:

    Please reboot the system after installing this update.

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Manager 1.7 for SLE 11 SP2:
      zypper in -t patch sleman17sp2-sm-ncc-sync-data=10671

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Manager 1.7 for SLE 11 SP2 (x86_64) [New Version: 1.5,1.7.1.13,1.7.30,1.7.38.34 and 1.7.7.12]:
      • smdba-1.5-0.6.2.1
      • spacecmd-1.7.7.12-0.5.1
      • spacewalk-backend-1.7.38.34-0.5.1
      • spacewalk-backend-app-1.7.38.34-0.5.1
      • spacewalk-backend-applet-1.7.38.34-0.5.1
      • spacewalk-backend-config-files-1.7.38.34-0.5.1
      • spacewalk-backend-config-files-common-1.7.38.34-0.5.1
      • spacewalk-backend-config-files-tool-1.7.38.34-0.5.1
      • spacewalk-backend-iss-1.7.38.34-0.5.1
      • spacewalk-backend-iss-export-1.7.38.34-0.5.1
      • spacewalk-backend-libs-1.7.38.34-0.5.1
      • spacewalk-backend-package-push-server-1.7.38.34-0.5.1
      • spacewalk-backend-server-1.7.38.34-0.5.1
      • spacewalk-backend-sql-1.7.38.34-0.5.1
      • spacewalk-backend-sql-oracle-1.7.38.34-0.5.1
      • spacewalk-backend-sql-postgresql-1.7.38.34-0.5.1
      • spacewalk-backend-tools-1.7.38.34-0.5.1
      • spacewalk-backend-xml-export-libs-1.7.38.34-0.5.1
      • spacewalk-backend-xmlrpc-1.7.38.34-0.5.1
      • spacewalk-backend-xp-1.7.38.34-0.5.1
      • spacewalk-branding-1.7.1.13-0.5.1
      • susemanager-1.7.30-0.5.2
      • susemanager-tools-1.7.30-0.5.2
    • SUSE Manager 1.7 for SLE 11 SP2 (noarch) [New Version: 1.7.21,1.7.54.34,1.7.56.24 and 1.7.9.12]:
      • sm-ncc-sync-data-1.7.21-0.5.1
      • spacewalk-java-1.7.54.34-0.5.1
      • spacewalk-java-config-1.7.54.34-0.5.1
      • spacewalk-java-lib-1.7.54.34-0.5.1
      • spacewalk-java-oracle-1.7.54.34-0.5.1
      • spacewalk-java-postgresql-1.7.54.34-0.5.1
      • spacewalk-setup-1.7.9.12-0.5.1
      • spacewalk-taskomatic-1.7.54.34-0.5.1
      • susemanager-schema-1.7.56.24-0.7.1

    References: