A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

Last updated 24 July 2024

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.

Last updated 24 July 2024

Oracle Java SE 8u201 fixes an unspecified vulnerability in the Deployment component (CVE-2019-2449). Upstream has CVSS scored this issue as: 3.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

External Reference:

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixJAVA

Last updated 24 July 2024

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

The NFS client implementation in the kernel in Red Hat Enterprise Linux (RHEL) 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfspermission (mode bits) data rather than an NFS ACCESS call to the server, which allows local client processes to obtain a false success status from open calls that the server would deny, and possibly obtain sensitive information about file permissions on the server, as demonstrated in a rootsquash environment. NOTE: it is uncertain whether any scenarios involving this issue cross privilege boundaries.

dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the sslkeypassword parameter value.

It was discovered that yum-rhn-plugin does not always properly verify SSL certificate against configured trusted CA certificate when communicating with Red Hat Network (RHN) server. SSL certificate was properly verified for XML-RPC communication, but the check was not applied to the file downloads.

This can possibly simplify man-in-the-middle attacks, allowing attacker to provide users with crafted repository meta-data files or RPM packages. However, GPG signatures are applied before installing any package, so an attacker could not use this to trick user to install packages from an untrusted source.

Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.

Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying the script.

ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file.

A cross-site scripting (XSS) flaw was found in the way the 'System Details' => 'Details' => 'Custom Info' page of the Red Hat Network Satellite web interface sanitized value (the Description field) of the asset tag / key, assigned to the particular system, created via 'Custom System Info' page. An authenticated Red Hat Network Satellite user could use this flaw to execute arbitrary HTML or web script code via specially-crafted value for the asset 'Custom System Info' key.

Acknowledgements:

Red Hat would like to thank William Hoffmann for reporting this issue.

The perf subsystem in the kernel package 2.6.32-122.el6.x8664 in Red Hat Enterprise Linux (RHEL) 6 does not properly handle NMIs, which might allow local users to cause a denial of service (excessive log messages) via unspecified vectors.

Augeas is a configuration management API that represents the contents of config files as a tree in memory for editing, with the edits being written back to the actual file. By default it loads files it understands in a large number of standard system locations (/etc, /boot), but can also open files in a user specified location [1],[2].

It has two save modes of interest, "backup" that keeps the original in PATH.augorig and "newfile" that leaves the file alone, but writes the edited version to PATH.augnew. These can be set via the API [3] or --backup/--new with augtool (CLI tool around the API).

A flaw was found in the current 0.10.0 version and most previous versions. It requires that the directory containing the file to be edited is writable by another user, so this needs the user to explicitly open a file in another location or for a file in a default location to be in a group/world writable directory.

This attack hinges on behaviour to support writing to a bind mount (ticket #32 gives some history [4] relating to oVirt?) when doing the rename fails with EBUSY or EXDEV. Augeas instead opens the file and writes straight into it, see transform.c in clonefile when copyifrenamefails is set from transformsave.

In two of the three, copyifrenamefails is only set if the node /augeas/save/copyifrenamefails is created by the user to enable the behaviour [4]. I think there are three ways to exploit this code.

1) with --backup

When creating PATH.augsave, copyifrenamefails is always set to 1. A bind mount of a single file (or FUSE, enabling non-privileged attacks?) at PATH.augsave would cause the file contents to be written to the bind mounted file.

2) with --new and /augeas/save/copyifrenamefails

As above, but create bind mount at PATH.augnew.

3) with --backup and /augeas/save/copyifrenamefails

Augeas first moves PATH to PATH.augsave for the backup, then renames PATH.augnew to PATH. There's a tiny window in which a bind mount could be created at PATH, so the file contents are written to the bind mounted file.

[1] http://augeas.net/page/Loadingspecificfiles [2] https://github.com/raphink/augeas-sandbox/blob/master/augload [3] http://augeas.net/docs/api.html#saving-the-tree [4] https://fedorahosted.org/augeas/ticket/32

Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-readable and world-writable permissions for /etc/csiaconfig.xml, which allows local users to change CSI Agent configuration by modifying this file.

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."

It was found that the fix for CVE-2012-5887 shipped for tomcat 6 on Red Hat Enterprise Linux 6 (RHSA-2013:0623) was incomplete. The fix only allowed DIGEST authentication to succeed when a stale nonce was provided, rather than when a stale nonce was NOT provided. As a result, DIGEST authentication did not function. However, a man-in-the-middle attacker could record a DIGEST authentication exchange, wait until the associated nonce is marked as stale on the server, then successfully replay this request.