Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title RPM vulnerabilities
Informations
Name USN-1695-1 First vendor Publication 2013-01-17
Vendor Ubuntu Last vendor Modification 2013-01-17
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 10.04 LTS

Summary:

RPM could be made to crash or run programs if it opened a specially crafted package file.

Software Description: - rpm: package manager for RPM

Details:

It was discovered that RPM incorrectly handled certain package headers. If a user or automated system were tricked into installing a specially crafted RPM package, an attacker could cause RPM to crash, resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
rpm 4.9.1.1-1ubuntu0.1

Ubuntu 11.10:
rpm 4.9.0-7ubuntu0.1

Ubuntu 10.04 LTS:
rpm 4.7.2-1lubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1695-1
CVE-2011-3378, CVE-2012-0060, CVE-2012-0061, CVE-2012-0815

Package Information:
https://launchpad.net/ubuntu/+source/rpm/4.9.1.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/rpm/4.9.0-7ubuntu0.1
https://launchpad.net/ubuntu/+source/rpm/4.7.2-1lubuntu0.1

Original Source

Url : http://www.ubuntu.com/usn/USN-1695-1

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-20 Improper Input Validation
25 % CWE-189 Numeric Errors (CWE/SANS Top 25)
25 % CWE-94 Failure to Control Generation of Code ('Code Injection')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17842
 
Oval ID: oval:org.mitre.oval:def:17842
Title: USN-1695-1 -- rpm vulnerabilities
Description: RPM could be made to crash or run programs if it opened a specially crafted package file.
Family: unix Class: patch
Reference(s): USN-1695-1
CVE-2011-3378
CVE-2012-0060
CVE-2012-0061
CVE-2012-0815
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20248
 
Oval ID: oval:org.mitre.oval:def:20248
Title: VMware ESXi and ESX updates to third party library and ESX Service Console
Description: RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Family: unix Class: vulnerability
Reference(s): CVE-2011-3378
 Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20408
 
Oval ID: oval:org.mitre.oval:def:20408
Title: VMware vSphere and vCOps updates to third party libraries
Description: RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.
Family: unix Class: vulnerability
Reference(s): CVE-2012-0060
 Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20497
 
Oval ID: oval:org.mitre.oval:def:20497
Title: VMware vSphere and vCOps updates to third party libraries
Description: The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.
Family: unix Class: vulnerability
Reference(s): CVE-2012-0815
 Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20634
 
Oval ID: oval:org.mitre.oval:def:20634
Title: VMware vSphere and vCOps updates to third party libraries
Description: The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.
Family: unix Class: vulnerability
Reference(s): CVE-2012-0061
 Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20938
 
Oval ID: oval:org.mitre.oval:def:20938
Title: RHSA-2012:0451: rpm security update (Important)
Description: The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.
Family: unix Class: patch
Reference(s): RHSA-2012:0451-03
CESA-2012:0451
CVE-2012-0060
CVE-2012-0061
CVE-2012-0815
 Version: 42
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21659
 
Oval ID: oval:org.mitre.oval:def:21659
Title: RHSA-2011:1349: rpm security update (Important)
Description: RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Family: unix Class: patch
Reference(s): RHSA-2011:1349-01
CESA-2011:1349
CVE-2011-3378
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
CentOS Linux 5
CentOS Linux 6
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23167
 
Oval ID: oval:org.mitre.oval:def:23167
Title: DEPRECATED: ELSA-2012:0451: rpm security update (Important)
Description: The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.
Family: unix Class: patch
Reference(s): ELSA-2012:0451-03
CVE-2012-0060
CVE-2012-0061
CVE-2012-0815
 Version: 18
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23316
 
Oval ID: oval:org.mitre.oval:def:23316
Title: DEPRECATED: ELSA-2011:1349: rpm security update (Important)
Description: RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Family: unix Class: patch
Reference(s): ELSA-2011:1349-01
CVE-2011-3378
 Version: 7
Platform(s): Oracle Linux 6
Oracle Linux 5
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23541
 
Oval ID: oval:org.mitre.oval:def:23541
Title: ELSA-2011:1349: rpm security update (Important)
Description: RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Family: unix Class: patch
Reference(s): ELSA-2011:1349-01
CVE-2011-3378
 Version: 6
Platform(s): Oracle Linux 6
Oracle Linux 5
 Product(s): rpm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23758
 
Oval ID: oval:org.mitre.oval:def:23758
Title: ELSA-2012:0451: rpm security update (Important)
Description: The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.
Family: unix Class: patch
Reference(s): ELSA-2012:0451-03
CVE-2012-0060
CVE-2012-0061
CVE-2012-0815
 Version: 17
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): rpm
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 109

OpenVAS Exploits

Date Description
2012-08-31 Name : VMSA-2012-0013 VMware vSphere and vCOps updates to third party libraries.
File : nvt/gb_VMSA-2012-0013.nasl
2012-08-30 Name : Fedora Update for rpm FEDORA-2012-5298
File : nvt/gb_fedora_2012_5298_rpm_fc17.nasl
2012-08-10 Name : Gentoo Security Advisory GLSA 201206-26 (RPM)
File : nvt/glsa_201206_26.nasl
2012-08-03 Name : Mandriva Update for rpm MDVSA-2012:056 (rpm)
File : nvt/gb_mandriva_MDVSA_2012_056.nasl
2012-07-30 Name : CentOS Update for popt CESA-2011:1349 centos5 x86_64
File : nvt/gb_CESA-2011_1349_popt_centos5_x86_64.nasl
2012-07-30 Name : CentOS Update for popt CESA-2012:0451 centos5
File : nvt/gb_CESA-2012_0451_popt_centos5.nasl
2012-07-30 Name : CentOS Update for rpm CESA-2012:0451 centos6
File : nvt/gb_CESA-2012_0451_rpm_centos6.nasl
2012-07-30 Name : CentOS Update for popt CESA-2011:1349 centos4 x86_64
File : nvt/gb_CESA-2011_1349_popt_centos4_x86_64.nasl
2012-04-23 Name : Fedora Update for rpm FEDORA-2012-5420
File : nvt/gb_fedora_2012_5420_rpm_fc15.nasl
2012-04-23 Name : Fedora Update for rpm FEDORA-2012-5421
File : nvt/gb_fedora_2012_5421_rpm_fc16.nasl
2012-04-05 Name : RedHat Update for rpm RHSA-2012:0451-01
File : nvt/gb_RHSA-2012_0451-01_rpm.nasl
2012-04-02 Name : Fedora Update for rpm FEDORA-2011-13766
File : nvt/gb_fedora_2011_13766_rpm_fc16.nasl
2012-03-15 Name : VMSA-2012-0001 VMware ESXi and ESX updates to third party library and ESX Ser...
File : nvt/gb_VMSA-2012-0001.nasl
2011-11-11 Name : CentOS Update for popt CESA-2011:1349 centos4 i386
File : nvt/gb_CESA-2011_1349_popt_centos4_i386.nasl
2011-10-14 Name : Fedora Update for rpm FEDORA-2011-13785
File : nvt/gb_fedora_2011_13785_rpm_fc15.nasl
2011-10-14 Name : Mandriva Update for rpm MDVA-2011:057 (rpm)
File : nvt/gb_mandriva_MDVA_2011_057.nasl
2011-10-10 Name : RedHat Update for rpm RHSA-2011:1349-01
File : nvt/gb_RHSA-2011_1349-01_rpm.nasl
2011-10-10 Name : CentOS Update for popt CESA-2011:1349 centos5 i386
File : nvt/gb_CESA-2011_1349_popt_centos5_i386.nasl
2011-10-10 Name : Mandriva Update for rpm MDVSA-2011:143 (rpm)
File : nvt/gb_mandriva_MDVSA_2011_143.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
75931 RPM Package Manager lib/header.c regionSwab() Function Region Offset RPM Pack...
75930 RPM Package Manager lib/header.c headerLoad() Function Region Offset RPM Pack...

Information Assurance Vulnerability Management (IAVM)

Date Description
2015-07-16 IAVM : 2015-A-0150 - Multiple Security Vulnerabilities in Juniper Networks CTPView
Severity : Category I - VMSKEY : V0061073
2012-09-27 IAVM : 2012-A-0153 - Multiple Vulnerabilities in VMware ESX 4.0 and ESXi 4.0
Severity : Category I - VMSKEY : V0033884
2012-09-13 IAVM : 2012-A-0148 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1
Severity : Category I - VMSKEY : V0033794
2012-02-02 IAVM : 2012-A-0020 - Multiple Vulnerabilities in VMware ESX 4.1 and ESXi 4.1
Severity : Category I - VMSKEY : V0031252

Nessus® Vulnerability Scanner

Date Description
2016-06-22 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0077.nasl - Type : ACT_GATHER_INFO
2016-03-03 Name : The remote VMware ESXi / ESX host is missing a security-related patch.
File : vmware_VMSA-2012-0001_remote.nasl - Type : ACT_GATHER_INFO
2016-02-29 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2012-0013_remote.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-140.nasl - Type : ACT_GATHER_INFO
2014-11-17 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2011-1408.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0531.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_rpm-111010.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_rpm-111010.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-260.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-259.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-61.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2011-14.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1349.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0451.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_popt-120419.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_popt-120420.nasl - Type : ACT_GATHER_INFO
2013-01-18 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1695-1.nasl - Type : ACT_GATHER_INFO
2012-08-31 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2012-0013.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111003_rpm_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120403_rpm_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-26.nasl - Type : ACT_GATHER_INFO
2012-04-23 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5420.nasl - Type : ACT_GATHER_INFO
2012-04-23 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5421.nasl - Type : ACT_GATHER_INFO
2012-04-12 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-056.nasl - Type : ACT_GATHER_INFO
2012-04-12 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5298.nasl - Type : ACT_GATHER_INFO
2012-04-04 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0451.nasl - Type : ACT_GATHER_INFO
2012-04-04 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0451.nasl - Type : ACT_GATHER_INFO
2012-01-31 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2012-0001.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_popt-7792.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_popt-111010.nasl - Type : ACT_GATHER_INFO
2011-11-03 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_popt-7793.nasl - Type : ACT_GATHER_INFO
2011-10-12 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13785.nasl - Type : ACT_GATHER_INFO
2011-10-10 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13766.nasl - Type : ACT_GATHER_INFO
2011-10-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-143.nasl - Type : ACT_GATHER_INFO
2011-10-04 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-1349.nasl - Type : ACT_GATHER_INFO
2011-10-04 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1349.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 12:01:21
  • Multiple Updates
2013-01-18 00:18:13
  • First insertion