Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorysecurity issuebug fixRed Hat Enterprise Linux 6 RHSA-2013-1674-02 Moderate: Dracut Security Fix
Updated dracut packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: dracut security, bug fix, and enhancement update Advisory ID: RHSA-2013:1674-02 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2013:1674.html Issue date: 2013-11-21 CVE Names: CVE-2012-4453 ==================================================================== 1. Summary: Updated dracut packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - noarch Red Hat Enterprise Linux Desktop Optional (v. 6) - noarch Red Hat Enterprise Linux HPC Node (v. 6) - noarch Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Enterprise Linux Server Optional (v. 6) - noarch Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Enterprise Linux Workstation Optional (v. 6) - noarch 3. Description: The dracut packages include an event-driven initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. It was discovered that dracut created initramfs imagesas world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information. (CVE-2012-4453) This issue was discovered by Peter Jones of the Red Hat Installer Team. These updated dracut packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All dracut users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 610462 - mkinitrd has no man page 720684 - Booting with snapshot of / requires non user-friendly config 859448 - CVE-2012-4453 dracut: Creates initramfs images with world-readable permissions (information disclosure) 912299 - kernel installation fails if GREP_OPTIONS is set 1012626 - [FIPS140] dracut-fip updates needed for certification 1019104 - Interface renaming via ifname does not work for RHEL-6.5 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: noarch: dracut-004-336.el6.noarch.rpm dracut-fips-004-336.el6.noarch.rpm dracut-kernel-004-336.el6.noarch.rpm dracut-network-004-336.el6.noarch.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: noarch: dracut-caps-004-336.el6.noarch.rpm dracut-fips-aesni-004-336.el6.noarch.rpm dracut-generic-004-336.el6.noarch.rpm dracut-tools-004-336.el6.noarch.rpm Red Hat Enterprise Linux HPC Node (v.6): Source: noarch: dracut-004-336.el6.noarch.rpm dracut-fips-004-336.el6.noarch.rpm dracut-kernel-004-336.el6.noarch.rpm dracut-network-004-336.el6.noarch.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: noarch: dracut-caps-004-336.el6.noarch.rpm dracut-fips-aesni-004-336.el6.noarch.rpm dracut-generic-004-336.el6.noarch.rpm dracut-tools-004-336.el6.noarch.rpm Red Hat Enterprise Linux Server (v. 6): Source: noarch: dracut-004-336.el6.noarch.rpm dracut-fips-004-336.el6.noarch.rpm dracut-kernel-004-336.el6.noarch.rpm dracut-network-004-336.el6.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: noarch: dracut-caps-004-336.el6.noarch.rpm dracut-fips-aesni-004-336.el6.noarch.rpm dracut-generic-004-336.el6.noarch.rpm dracut-tools-004-336.el6.noarch.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: noarch: dracut-004-336.el6.noarch.rpm dracut-fips-004-336.el6.noarch.rpm dracut-kernel-004-336.el6.noarch.rpm dracut-network-004-336.el6.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: noarch: dracut-caps-004-336.el6.noarch.rpm dracut-fips-aesni-004-336.el6.noarch.rpm dracut-generic-004-336.el6.noarch.rpm dracut-tools-004-336.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-4453 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/dracut.html#RHSA-2013-1674 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSjY/DXlSAg2UNWIIRAku4AKCcw5yzjZp3tX9ASlR/wqEl7YYdZACgmEA/ J5hKU5XeI6YXdWsDGAVq+Uc=GhQn -----END PGP SIGNATURE----- -- Enterprise-watch-listmailing list
Nov 21, 2013
Red Hat
100
security advisorysecurity updatelocal privilege escalationSUSE: 2006-040 Moderate: KDM Local Data Leakage Vulnerability
The KDE Display Manager KDM stores the type of the previously used The KDE Display Manager KDM stores the type of the previously used session in the user's home directory. session in the user's home directory. By using a symlink a local attacker could trick kdm into also storing content of files that are normally not accessible by users, like for instance /etc/shadow.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: kdebase3-kdm Announcement ID: SUSE-SA:2006:039 Date: Mon, 03 Jul 2006 16:00:00 +0000 Affected Products: Novell Linux Desktop 9 SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SUSE SLES 9 Vulnerability Type: local privilege escalation Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2006-2449 Content of This Advisory: 1) Security Vulnerability Resolved: KDM local information exposure Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The KDE Display Manager KDM stores the type of the previously used session in the user's home directory. By using a symlink a local attacker could trick kdm into also storing content of files that are normally not accessible by users, likefor instance /etc/shadow. This problem is tracked by Mitre CVE ID CVE-2006-2449 and was found by Ludwig Nussel of the SUSE Security Team. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please restart all running instances of kdm after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.1: 6b51aa1795da71a71119cf6aa6820153 SUSE LINUX 10.0: 5b36c9bc7cee1cdde72d7ad70860d596 SUSE LINUX 9.3: f5a7cc054bf5223057e36aeef4bb2e55 SUSE LINUX 9.2: e3b919080e181d5854526410675e116e SUSE LINUX 9.1: 247b449b8b6142ff9ee413acbd4efc57 Power PC Platform: SUSE LINUX 10.1: 6db4614fe15867245801e17c72e9c8bd SUSE LINUX 10.0: 6366c0536eb41220bd1686513fe6e2c1 x86-64 Platform: SUSE LINUX 10.1: 6c31f10bd18a53f585a1cc6ac45ccbe4 SUSE LINUX 10.0: f606da7a6561ec09fbbb70a467da1790 SUSE LINUX 9.3: fece9cedbe4033094c62124d85fe37cd SUSE LINUX 9.2: 421cfc9dcacc8d1a59009cc849182297 SUSE LINUX 9.1: 3456c10099c7c075ef2653e750f0ad72 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: Novell Linux Desktop 9 SUSE SLES 9 ______________________________________________________________________________ 5)Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package,replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Jul 03, 2006
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!