Executive Summary

Summary
Title rhn-client-tools security update
Informations
Name RHSA-2010:0449 First vendor Publication 2010-06-01
Vendor RedHat Last vendor Modification 2010-06-01
Severity (Vendor) Moderate Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score 3.6 Attack Range Local
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated rhn-client-tools packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - noarch Red Hat Enterprise Linux Desktop (v. 5 client) - noarch

3. Description:

Red Hat Network Client Tools provide programs and libraries that allow your system to receive software updates from the Red Hat Network (RHN).

It was discovered that rhn-client-tools set insecure permissions on the loginAuth.pkl file, used to store session credentials for authenticating connections to Red Hat Network servers. A local, unprivileged user could use these credentials to download packages from the Red Hat Network. They could also manipulate package or action lists associated with the system's profile. (CVE-2010-1439)

Users of rhn-client-tools are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

4. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

585386 - CVE-2010-1439 rhn-client-tools: authorized information disclosure

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2010-0449.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21382
 
Oval ID: oval:org.mitre.oval:def:21382
Title: RHSA-2010:0449: rhn-client-tools security update (Moderate)
Description: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Family: unix Class: patch
Reference(s): RHSA-2010:0449-01
CVE-2010-1439
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
 Product(s): rhn-client-tools
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23151
 
Oval ID: oval:org.mitre.oval:def:23151
Title: ELSA-2010:0449: rhn-client-tools security update (Moderate)
Description: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Family: unix Class: patch
Reference(s): ELSA-2010:0449-01
CVE-2010-1439
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): rhn-client-tools
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9232
 
Oval ID: oval:org.mitre.oval:def:9232
Title: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Description: yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1439
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2010-06-07 Name : RedHat Update for rhn-client-tools RHSA-2010:0449-01
File : nvt/gb_RHSA-2010_0449-01_rhn-client-tools.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
65063 Red Hat rhn-client-tools /var/spool/up2date/loginAuth.pkl Insecure File Permi...

Nessus® Vulnerability Scanner

Date Description
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100601_rhn_client_tools_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2010-06-02 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0449.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:53:32
  • Multiple Updates