Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

SciLinux: 2016-2592-2 Moderate: subscription-manager Information Disclosure

Calendar Jan 09, 2017 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Scientific Large Esm H446
Topics%20covered

Topics Covered

security advisory moderate bug fix information disclosure subscription-manager SL7
Moderate: subscription-manager security, bug fix, and enhancement update 
Date: Mon, 9 Jan 2017 20:25:31 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: subscription-manager on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20170109202531.24297.95350@slpackages.fnal.gov>

Synopsis: Moderate: subscription-manager security, bug fix, and enhancement update
Advisory ID: SLSA-2016:2592-2
Issue Date: 2016-11-03
CVE Numbers: CVE-2016-4455
--

* It was found that subscription-manager set weak permissions on files in
/var/lib/rhsm/, causing an information disclosure. A local, unprivileged
user could use this flaw to access sensitive data that could potentially
be used in a social engineering attack. (CVE-2016-4455)
--

SL7
 x86_64
 python-rhsm-1.17.9-1.el7.x86_64.rpm
 python-rhsm-certificates-1.17.9-1.el7.x86_64.rpm
 python-rhsm-debuginfo-1.17.9-1.el7.x86_64.rpm
 subscription-manager-1.17.15-1.el7.x86_64.rpm
 subscription-manager-debuginfo-1.17.15-1.el7.x86_64.rpm
 subscription-manager-gui-1.17.15-1.el7.x86_64.rpm
 subscription-manager-initial-setup-addon-1.17.15-1.el7.x86_64.rpm
 subscription-manager-migration-1.17.15-1.el7.x86_64.rpm
 subscription-manager-plugin-container-1.17.15-1.el7.x86_64.rpm
 subscription-manager-plugin-ostree-1.17.15-1.el7.x86_64.rpm
 noarch
 subscription-manager-migration-data-2.0.31-1.el7.noarch.rpm

- Scientific Linux Development Team