PT-2017-17774 · Red Hat+3 · Rpm+3

Published 2017-10-30 · Updated 2022-11-29 · CVE-2017-7501

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rpm versions prior to 4.13.0.2

Description A security issue was discovered where rpm uses temporary files with predictable names during installation. This could allow an attacker with write access to the installation directory to create symbolic links to arbitrary locations, potentially modifying file content and permissions. This could lead to denial of service or possibly privilege escalation.

Recommendations For versions prior to 4.13.0.2, update to version 4.13.0.2 or later to resolve the issue.

Fix

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2021-2518

ALT-PU-2021-2600

CVE-2017-7501

ECHO-6B80-EF11-AE2D

MGASA-2017-0394

OPENSUSE-SU-2018_3373-1

SUSE-SU-2018:3286-1

SUSE-SU-2018:3884-1

SUSE-SU-2018:3884-2

Affected Products

Alt Linux

Debian

Suse

Rpm

References · 87

• https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3421 · Security Note
• https://bdu.fstec.ru/vul/2015-05391 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 · Security Note
• https://bdu.fstec.ru/vul/2015-04520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2197 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0060 · Security Note
• https://bdu.fstec.ru/vul/2015-04516 · Security Note
• https://bdu.fstec.ru/vul/2015-06484 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20266 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7501 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199 · Security Note
• https://bdu.fstec.ru/vul/2015-04521 · Security Note
• https://bdu.fstec.ru/vul/2015-04515 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501 · Security Note