Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Moderate Advisory SLSA-2017:0698-1 Regarding Info Exposure in SL6 Manager

Calendar Apr 05, 2017 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Scientific Large Esm H446
Topics%20covered

Topics Covered

security advisory moderate information disclosure subscription-manager SL6
Moderate: subscription-manager security, bug fix, and enhancement update 
Date: Wed, 5 Apr 2017 15:20:45 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: subscription-manager on SL6.x
 i386/x86_64
MIME-Version: 1.0
Message-ID: <20170405152045.5358.53316@slpackages.fnal.gov>

Synopsis: Moderate: subscription-manager security, bug fix, and enhancement update
Advisory ID: SLSA-2017:0698-1
Issue Date: 2017-03-21
CVE Numbers: CVE-2016-4455
--

Security Fix(es):

* It was found that subscription-manager set weak permissions on files in
/var/lib/rhsm/, causing an information disclosure. A local, unprivileged
user could use this flaw to access sensitive data that could potentially
be used in a social engineering attack. (CVE-2016-4455)
--

SL6
 x86_64
 python-rhsm-1.18.6-1.el6.x86_64.rpm
 python-rhsm-certificates-1.18.6-1.el6.x86_64.rpm
 python-rhsm-debuginfo-1.18.6-1.el6.x86_64.rpm
 subscription-manager-1.18.10-1.el6.x86_64.rpm
 subscription-manager-debuginfo-1.18.10-1.el6.x86_64.rpm
 subscription-manager-firstboot-1.18.10-1.el6.x86_64.rpm
 subscription-manager-gui-1.18.10-1.el6.x86_64.rpm
 subscription-manager-migration-1.18.10-1.el6.x86_64.rpm
 subscription-manager-plugin-container-1.18.10-1.el6.x86_64.rpm
 i386
 python-rhsm-1.18.6-1.el6.i686.rpm
 python-rhsm-certificates-1.18.6-1.el6.i686.rpm
 python-rhsm-debuginfo-1.18.6-1.el6.i686.rpm
 subscription-manager-1.18.10-1.el6.i686.rpm
 subscription-manager-debuginfo-1.18.10-1.el6.i686.rpm
 subscription-manager-firstboot-1.18.10-1.el6.i686.rpm
 subscription-manager-gui-1.18.10-1.el6.i686.rpm
 subscription-manager-migration-1.18.10-1.el6.i686.rpm
 subscription-manager-plugin-container-1.18.10-1.el6.i686.rpm
 noarch
 subscription-manager-migration-data-2.0.34-1.el6.noarch.rpm

- Scientific Linux Development Team