PT-2012-1125 · Rpm+4 · Rpm+4
Ramon De C Valle
·
Published
2012-04-03
·
Updated
2021-08-23
·
CVE-2012-0060
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RPM versions prior to 4.9.1.3
Description
The issue is related to the improper validation of region tags in RPM, which can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. This can be achieved by sending an invalid region tag in a package header to specific functions, including the headerLoad, rpmReadSignature, or headerVerify function. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information.
Recommendations
For versions prior to 4.9.1.3, update to version 4.9.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the headerLoad, rpmReadSignature, and headerVerify functions until a patch is available. Avoid using invalid region tags in package headers to minimize the risk of exploitation.
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Rpm
Red Hat
Suse