CVE-2010-1439
First published: Fri Apr 23 2010(Updated: )
It was found that the yum-rhn-plugin caches sensitive authentication information in the world-readable /var/spool/up2date/loginAuth.pkl file. This information could be used to download packages from Red Hat Network (Hosted or Satellite) or otherwise manipulate the package list associated with the system's profile, which could possibly prevent new errata from being installed.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Rhn-client-tools | ||
| Redhat Yum-rhn-plugin | ||
| Fedoraproject Fedora | ||
| Redhat Enterprise Linux | =5 | |
| Redhat Enterprise Linux | =5-ga | |
| Redhat Enterprise Linux | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=585386
- http://www.redhat.com/support/errata/RHSA-2010-0449.html
- http://www.vupen.com/english/advisories/2010/1311
- http://securitytracker.com/id?1024049
- http://secunia.com/advisories/39996
- http://www.securityfocus.com/bid/40492
- http://www.osvdb.org/65063
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59114
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9232
- https://rhn.redhat.com/errata/RHSA-2010-0449.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=598642
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-1439
- vendor/redhat
- canonical/redhat rhn-client-tools
- canonical/redhat yum-rhn-plugin
- vendor/fedoraproject
- canonical/fedoraproject fedora
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5
- version/redhat enterprise linux/5-ga
- version/redhat enterprise linux/5.0