PT-2010-3126 · Red Hat · Fedora+3

Vincent Danen · Publicado 2010-06-01 · Atualizado 2017-09-19 · CVE-2010-1439

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Network Client Tools (aka rhn-client-tools) versions on Red Hat Enterprise Linux (RHEL) 5 and Fedora

Description The issue concerns the yum-rhn-plugin in Red Hat Network Client Tools, which uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file. This allows local users to access the Red Hat Network profile by leveraging authentication data from this file, and possibly prevent future security updates.

Recommendations For Red Hat Enterprise Linux (RHEL) 5 and Fedora, consider changing the permissions of the /var/spool/up2date/loginAuth.pkl file to prevent world-readable access until a patch is available. As a temporary workaround, restrict access to the loginAuth.pkl file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1439

RHSA-2010:0449

RHSA-2010_0449

Produtos afetados

Fedora

Red Hat

Red Hat Network Client Tools

Yum-Rhn-Plugin

Referências · 12

• http://securityfocus.com/bid/40492 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9232 · Nota
• https://access.redhat.com/errata/RHSA-2010:0449 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1439 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2010-1439 · Nota
• http://redhat.com/support/errata/RHSA-2010-0449.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59114 · Nota
• http://osvdb.org/65063 · Nota
• http://secunia.com/advisories/39996 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1311 · Aviso do Fabricante
• http://securitytracker.com/id?1024049 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=585386 · Nota