Scientific Linux SL5.x: CVE-2007-4129 Low Severity Coolkey Fix

Date:         Tue, 13 Nov 2007 16:46:49 -0600
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA for coolkey on SL5.x i386/x86_64
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.

Synopsis:	Low: coolkey security and bug fix update
Issue date:	2007-11-07
CVE Names:	CVE-2007-4129

Steve Grubb discovered a flaw in the way coolkey created a temporary
directory. A local attacker could perform a symlink attack and cause
arbitrary files to be overwritten. (CVE-2007-4129)

In addition, the updated packages contain fixes for the following bugs 
in the CAC Smart Card support:

* CAC Smart Cards can have from 1 to 3 certificates. The coolkey driver,
however, was not recognizing cards if they had less than 3 certificates.

* logging into a CAC Smart Card token with a new application would cause
other, already authenticated, applications to lose their login status
unless the Smart Card was then removed from the reader and re-inserted

SL 5.x

   SRPMS:
coolkey-1.1.0-5.el5.src.rpm
   i386:
coolkey-1.1.0-5.el5.i386.rpm
coolkey-devel-1.1.0-5.el5.i386.rpm
   x86_64:
coolkey-1.1.0-5.el5.i386.rpm
coolkey-1.1.0-5.el5.x86_64.rpm
coolkey-devel-1.1.0-5.el5.i386.rpm
coolkey-devel-1.1.0-5.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson