Executive Summary

Informations
NameCVE-2010-1439First vendor Publication2010-06-07
VendorCveLast vendor Modification2010-08-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score3.6Attack RangeLocal
Cvss Impact Score4.9Attack ComplexityLow
Cvss Expoit Score3.9AuthentificationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1439

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9232
 
Oval ID: oval:org.mitre.oval:def:9232
Title: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Description: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1439
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

Open Source Vulnerability Database (OSVDB)

idDescription
65063Red Hat rhn-client-tools /var/spool/up2date/loginAuth.pkl Insecure File Permi...

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/40492
CONFIRMhttps://bugzilla.redhat.com/show_bug.cgi?id=585386
OSVDBhttp://www.osvdb.org/65063
REDHAThttp://www.redhat.com/support/errata/RHSA-2010-0449.html
SECTRACKhttp://securitytracker.com/id?1024049
SECUNIAhttp://secunia.com/advisories/39996
VUPENhttp://www.vupen.com/english/advisories/2010/1311
XFhttp://xforce.iss.net/xforce/xfdb/59114

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2013-05-10 23:23:01
  • Multiple Updates