CVE-2010-2199

First published: Tue Jun 01 2010(Updated: )

Common Vulnerabilities and Exposures assigned an identifier <a href="https://access.redhat.com/security/cve/CVE-2010-2199">CVE-2010-2199</a> to the following vulnerability: Name: <a href="https://access.redhat.com/security/cve/CVE-2010-2199">CVE-2010-2199</a> URL: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199</a> Assigned: 20100608 Reference: CONFIRM: <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED UPSTREAM - CVE-2005-4889 rpm: Updates leave hardlinked copies untouched." href="show_bug.cgi?id=125517">https://bugzilla.redhat.com/show_bug.cgi?id=125517</a> lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to bypass intended access restrictions by creating a hard link to a vulnerable file that has a POSIX ACL, a related issue to <a href="https://access.redhat.com/security/cve/CVE-2010-2059">CVE-2010-2059</a>. See <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2010-2059 rpm: fails to drop SUID/SGID bits on package upgrade" href="show_bug.cgi?id=598775">bug #598775</a> for an initial description and comments of this issue. Because different CVE names were assigned for different, yet related, issues, a separate bug has been filed for this particular issue.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Rpm Rpm	=2.3.5
Rpm Rpm	=4.4.2.1
Rpm Rpm	=1.4.3
Rpm Rpm	=3.0.1
Rpm Rpm	=4.1
Rpm Rpm	=2.2.3.11
Rpm Rpm	=2.4.4
Rpm Rpm	=2.3.8
Rpm Rpm	=2.0.6
Rpm Rpm	=1.4.4
Rpm Rpm	=4.4.2
Rpm Rpm	=1.4.2\/a
Rpm Rpm	=2.4.1
Rpm Rpm	=2.4.9
Rpm Rpm	=2.6.7
Rpm Rpm	=2..4.10
Rpm Rpm	=1.4
Rpm Rpm	=2.0.10
Rpm Rpm	=2.4.5
Rpm Rpm	=4.0.1
Rpm Rpm	=2.2.11
Rpm Rpm	=4.0.4
Rpm Rpm	=2.2.1
Rpm Rpm	=2.0.1
Rpm Rpm	=1.4.2
Rpm Rpm	=3.0.3
Rpm Rpm	=2.0.7
Rpm Rpm	=4.0.2
Rpm Rpm	=2.2.8
Rpm Rpm	=3.0.2
Rpm Rpm	=1.2
Rpm Rpm	=4.0.
Rpm Rpm	=2.1.1
Rpm Rpm	=4.3.3
Rpm Rpm	=2.5.5
Rpm Rpm	=2.0.8
Rpm Rpm	=2.3
Rpm Rpm	=4.4.2.2
Rpm Rpm	=2.4.8
Rpm Rpm	=3.0.4
Rpm Rpm	=2.5.6
Rpm Rpm	=2.0
Rpm Rpm	=2.0.2
Rpm Rpm	=2.3.2
Rpm Rpm	=2.4.3
Rpm Rpm	=2.4.2
Rpm Rpm	=1.4.5
Rpm Rpm	=2.0.11
Rpm Rpm	=3.0.5
Rpm Rpm	=1.3
Rpm Rpm	=2.2.3
Rpm Rpm	=2.2
Rpm Rpm	=2.1.2
Rpm Rpm	=2.3.9
Rpm Rpm	=2.2.4
Rpm Rpm	=2.2.9
Rpm Rpm	=2.5.3
Rpm Rpm	=2.2.6
Rpm Rpm	=2.3.6
Rpm Rpm	=2.5
Rpm Rpm	=2.2.3.10
Rpm Rpm	=2.0.5
Rpm Rpm	=4.4.2.3
Rpm Rpm	=2.4.12
Rpm Rpm	=2.5.4
Rpm Rpm	=1.4.7
Rpm Rpm	=3.0
Rpm Rpm	=1.4.6
Rpm Rpm	=2.5.2
Rpm Rpm	=2.4.11
Rpm Rpm	=2.0.9
Rpm Rpm	=2.1
Rpm Rpm	=2.2.10
Rpm Rpm	=2.3.3
Rpm Rpm	=2.3.7
Rpm Rpm	=2.3.4
Rpm Rpm	=2.0.4
Rpm Rpm	=1.3.1
Rpm Rpm	=3.0.6
Rpm Rpm	=2.0.3
Rpm Rpm	=2.3.1
Rpm Rpm	=4.0.3
Rpm Rpm	=2.4.6
Rpm Rpm	=2.5.1
Rpm Rpm	=2.2.5
Rpm Rpm	=2.2.2
Rpm Rpm	=2.2.7
Rpm Rpm	=4.6.0
Rpm Rpm	<=4.8.0
Rpm Rpm	=4.7.2
Rpm Rpm	=4.7.0
Rpm Rpm	=4.6.1
Rpm Rpm	=4.7.1

CVE-2010-2199

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact