{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The Red Hat Enterprise Linux 6.4 KVM Guest Image for cloud instances had\nan empty root password by default.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat provides a Red Hat Enterprise Linux 6.4 KVM Guest Image for\ncloud instances. This image is provided as a minimally configured system\nimage which is available for use as-is or for configuration and\ncustomization as required by end users.\n\nThe Red Hat Enterprise Linux 6.4 KVM Guest Image for cloud instances had an\nempty root password by default. To address this, Red Hat has created an\nupdated image that locks the root password by default. This updated image\nis now available on RHN.\n\nTo correct existing Red Hat Enterprise Linux 6.4 KVM Guest Images, any\nimages or systems built using this Red Hat Enterprise Linux 6.4 KVM Guest\nImage, or any currently running Red Hat Enterprise Linux instances\ninstantiated from this image, users can lock the root password by issuing,\nas root, the command:\n\npasswd -l root\n\nNote: The default OpenSSH configuration disallows password logins when\nthe password is empty, preventing a remote attacker from logging in\nwithout a password.\n\nRoot Cause\n\nKickstart can be used to automate operating system installations. A\nKickstart file specifies settings for an installation. Once the\ninstallation system boots, it can read a Kickstart file and carry out the\ninstallation process without any further input from a user. Kickstart is\nused as part of the process of creating Images of Red Hat Enterprise Linux\nfor cloud providers.\n\nIt was discovered that when no \u0027rootpw\u0027 command was specified in a\nKickstart file, the image creator tools gave the root user an empty\npassword rather than leaving the password locked, which could allow a local\nuser to gain access to the root account (CVE-2013-2069).\n\nWe have corrected this issue by updating the Kickstart file used to build\naffected images to lock the password file.\n\nThis issue was caused by the way a tool was used to create Images, and not\ndue to a security vulnerability in Red Hat Enterprise Linux.\n\nTo import the image into an OpenStack environment, download the image from\nRed Hat Network to a system that has the python-glanceclient package\ninstalled. Refer to the OpenStack Getting Started Guide, linked to in the\nReferences, for information on importing the image into an OpenStack\nenvironment. After successfully importing, it is also highly recommended\nthat the \"glance delete\" command is used to delete any previous versions of\nthe image that exist in the Glance image registry.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0849",
        "url": "https://access.redhat.com/errata/RHSA-2013:0849"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=16952",
        "url": "https://rhn.redhat.com/rhn/software/channel/downloads/Download.do?cid=16952"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_OpenStack/2/html/Getting_Started_Guide/ch09s02.html",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_OpenStack/2/html/Getting_Started_Guide/ch09s02.html"
      },
      {
        "category": "external",
        "summary": "964299",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=964299"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0849.json"
      }
    ],
    "title": "Red Hat Security Advisory: KVM image security update",
    "tracking": {
      "current_release_date": "2026-01-28T22:34:50+00:00",
      "generator": {
        "date": "2026-01-28T22:34:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2013:0849",
      "initial_release_date": "2013-05-23T13:31:00+00:00",
      "revision_history": [
        {
          "date": "2013-05-23T13:31:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-05-23T14:34:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:34:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Common"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Amazon Web Services"
          ]
        }
      ],
      "cve": "CVE-2013-2069",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "discovery_date": "2013-05-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "964299"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that when used to create images, livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no \u0027rootpw\u0027 directive was used or when the \u0027rootpw --lock\u0027 directive was used within the Kickstart file, which could allow local users to gain access to the root account.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "livecd-tools: improper handling of passwords",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux Server (v. 6)"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2069"
        },
        {
          "category": "external",
          "summary": "RHBZ#964299",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=964299"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2069"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2069",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2069"
        }
      ],
      "release_date": "2013-05-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-05-23T13:31:00+00:00",
          "details": "The updated image is available from RHN, linked to in the References.",
          "product_ids": [
            "Red Hat Enterprise Linux Server (v. 6)"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0849"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "products": [
            "Red Hat Enterprise Linux Server (v. 6)"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "livecd-tools: improper handling of passwords"
    }
  ]
}