Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Red Hat Enterprise Linux 6: RHSA-2012-0841-04 Low: ABRT & Libreport Update

red hat
Calendar Grey June 20, 2012
Scroller Redhat
Red Hat releases enhancements for abrt, libreport, btparser, and python-meh that tackle two minor security issues.
Updated abrt, libreport, btparser, and python-meh packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Summary

ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in applications to different bug targets, such as Bugzilla, FTP, and Trac.
The btparser utility is a backtrace parser and analyzer library, which works with backtraces produced by the GNU Project Debugger. It can parse a text file with a backtrace to a tree of C structures, allowing to analyze the threads and frames of the backtrace and process them.
The python-meh package provides a python library for handling exceptions.
If the C handler plug-in in ABRT was enabled (the abrt-addon-ccpp package installed and the abrt-ccpp service running), and the sysctl fs.suid_dumpable option was set to "2" (it is "0" by default), core dumps of set user ID (setuid) programs were created with insecure group ID permissions. This could allow local, unprivileged users to obtain sensitive information from the core dump files of setuid processes they would otherwise not be able to access. (CVE-2012-1106)
ABRT did not allow users to easily search the collected crash information for sensitive data prior to submitting it. This could lead to usersunintentionally exposing sensitive information via the submitted crash reports. This update adds functionality to search across all the collected data. Note that this fix does not apply to the default configuration, where reports are sent to Red Hat Customer Support. It only takes effect for users sending information to Red Hat Bugzilla. (CVE-2011-4088)
Red Hat would like to thank Jan Iven for reporting CVE-2011-4088.
These updated packages include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.
All users of abrt, libreport, btparser, and python-meh are advised to upgrade to these updated packages, which correct these issues.

Topics%20covered

Topics Covered

security advisory Red Hat Enterprise Linux low severity abrt update libreport update btparser fix python-meh fix

References

https://access.redhat.com/security/cve/CVE-2011-4088 https://access.redhat.com/security/cve/CVE-2012-1106 https://access.redhat.com/security/updates/classification#low https://access.redhat.com/search/

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source:
i386: btparser-0.16-3.el6.i686.rpm btparser-debuginfo-0.16-3.el6.i686.rpm libreport-2.0.9-5.el6.i686.rpm libreport-cli-2.0.9-5.el6.i686.rpm libreport-debuginfo-2.0.9-5.el6.i686.rpm libreport-gtk-2.0.9-5.el6.i686.rpm libreport-newt-2.0.9-5.el6.i686.rpm libreport-plugin-kerneloops-2.0.9-5.el6.i686.rpm libreport-plugin-logger-2.0.9-5.el6.i686.rpm libreport-plugin-mailx-2.0.9-5.el6.i686.rpm libreport-plugin-reportuploader-2.0.9-5.el6.i686.rpm libreport-plugin-rhtsupport-2.0.9-5.el6.i686.rpm libreport-python-2.0.9-5.el6.i686.rpm
noarch: python-meh-0.12.1-3.el6.noarch.rpm
x86_64: btparser-0.16-3.el6.x86_64.rpm btparser-debuginfo-0.16-3.el6.x86_64.rpm libreport-2.0.9-5.el6.i686.rpm libreport-2.0.9-5.el6.x86_64.rpm libreport-cli-2.0.9-5.el6.x86_64.rpm libreport-debuginfo-2.0.9-5.el6.i686.rpm libreport-debuginfo-2.0.9-5.el6.x86_64.rpm libreport-gtk-2.0.9-5.el6.i686.rpm libreport-gtk-2.0.9-5.el6.x86_64.rpm libreport-newt-2.0.9-5.el6.x86_64.rpm libreport-plugin-kerneloops-2.0.9-5.el6.x86_64.rpm libreport-plugin-logger-2.0.9-5.el6.x86_64.rpm libreport-plugin-mailx-2.0.9-5.el6.x86_64.rpm libreport-plugin-reportuploader-2.0.9-5.el6.x86_64.rpm libreport-plugin-rhtsupport-2.0.9-5.el6.x86_64.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2012:0841-04
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2012:0841.html
Issue date: 2012-06-20

Topic

Updated abrt, libreport, btparser, and python-meh packages that fix twosecurity issues and several bugs are now available for Red Hat EnterpriseLinux 6.The Red Hat Security Response Team has rated this update as having lowsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat Enterprise Linux low severity abrt update libreport update btparser fix python-meh fix

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

625485 - XML report generated by report lib from within Anaconda is not valid XML

727494 - [RFE] warn if user wants to re-report the same problem

745976 - "Report problem with ABRT" creates incomplete reports

746727 - /tmp/anaconda-tb-* is not handled properly

747594 - Can't proceed from "Select reporter" window when item is deselected

747624 - abrt-cli man page is missing

749100 - abrt-dump-oops contains non-translatable strings

749854 - CVE-2011-4088 abrt: may leak some personal information to bugzilla with some certain applications

751068 - abrt-cli shouldn't require abrt-addon-python

758366 - Typo in /etc/libreport/events.d/python_event.conf

759375 - ABRT rebase

759377 - libreport rebase

768377 - btparser rebase

770357 - default config file for mailx is missing

773242 - Moved copy

785163 - CVE-2012-1106 abrt: Setuid process core dump archived with unsafe GID permissions

796176 - Run all unit tests in build process

796216 - Double free in abrt-action-analyze-oops.c

799027 - ABRT-INSTALL-CCPPH(1) man page is misleading

803618 - ABRT mailx plugin on by default causes crashes being always labelled as reported

811147 - Report correct crash_function in the crash sumary

823411 - Searching for duplicate anaconda bugs while reporting exception against partner-bugzilla during install fails

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.