CVE-2013-6435: Race Condition
IssueDescription:
It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation.
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Other sources
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6435?
CVE-2013-6435 has a high severity rating due to its potential to allow unverified file execution.
How do I fix CVE-2013-6435?
To fix CVE-2013-6435, you should upgrade to a version of RPM Package Manager that is newer than 4.11.1 and apply the available security patch.
What systems are affected by CVE-2013-6435?
CVE-2013-6435 affects various versions of the RPM Package Manager, including versions from 1.2 up to 4.11.1.
What type of vulnerability is CVE-2013-6435?
CVE-2013-6435 is classified as a file handling vulnerability that involves the processing of unverified temporary files.
Is there a workaround for CVE-2013-6435?
While the best solution is to update RPM, temporarily restricting access to unverified files can serve as a workaround until an update is applied.