Stay Secure with the Latest Linux Advisories

security advisorysecurity updatebuffer overflow

RedHat: RHSA-2020-1486-01 Important: Ipmitool Buffer Overflow Threat

An update for ipmitool is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, . -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ipmitool security update Advisory ID: RHSA-2020:1486-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1486 Issue date: 2020-04-16 CVE Names: CVE-2020-5208 ==================================================================== 1. Summary: An update for ipmitool is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) - noarch Red Hat Enterprise Linux Server EUS (v. 7.5) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.5) - noarch 3. Description: The ipmitool packages contain a command-line utility for interfacing with devices that support the Intelligent Platform Management Interface (IPMI) specification. IPMI is an open standard for machine health, inventory, and remote power control. Security Fix(es): * ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c (CVE-2020-5208) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the Referencessection. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1798721 - CVE-2020-5208 ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5): Source: ipmitool-1.8.18-9.el7_5.src.rpm x86_64: ipmitool-1.8.18-9.el7_5.x86_64.rpm ipmitool-debuginfo-1.8.18-9.el7_5.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5): noarch: bmc-snmp-proxy-1.8.18-9.el7_5.noarch.rpm exchange-bmc-os-info-1.8.18-9.el7_5.noarch.rpm Red Hat Enterprise Linux Server EUS (v. 7.5): Source: ipmitool-1.8.18-9.el7_5.src.rpm ppc64: ipmitool-1.8.18-9.el7_5.ppc64.rpm ipmitool-debuginfo-1.8.18-9.el7_5.ppc64.rpm ppc64le: ipmitool-1.8.18-9.el7_5.ppc64le.rpm ipmitool-debuginfo-1.8.18-9.el7_5.ppc64le.rpm s390x: ipmitool-1.8.18-9.el7_5.s390x.rpm ipmitool-debuginfo-1.8.18-9.el7_5.s390x.rpm x86_64: ipmitool-1.8.18-9.el7_5.x86_64.rpm ipmitool-debuginfo-1.8.18-9.el7_5.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 7.5): noarch: bmc-snmp-proxy-1.8.18-9.el7_5.noarch.rpm exchange-bmc-os-info-1.8.18-9.el7_5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-5208 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE-----Version: GnuPGv1 iQIVAwUBXpgcuNzjgjWX9erEAQhZBhAAllan1wVnUffHNKQXsLdmIOUtnP3wSVYV 7RoH8f8CfwSP5ZW9LHboM7Uc/NNaIFTgPhJI1JBP3/bu0AXGZVWZcFMbExLUC3qg rqIqlK+g0M6xR21ZclDClpKB/z3lMzfmBDWf3D1uYni930Vq85oROsmRIOziwS3q JL4IXmZSt0BWvKByVmIhXpbgKnWS1J2ixrgLi0BkDIb+vevMQ+Jabb+MgTXHkZ/o PDveNV+4BPgTSWuuGIEeAyNVxJf76NOZh9sNawaiioY4/2uUysw9IUFkTT+hrBEl 21gizkPgqxVOAXIGGiyLBZJIdBQ9Z0wS673/9DbNXXorb2f/4Lr3vjpBQDBXibG9 fi+j1Arhog0617V+KKl/tDfNgKv/uKY2Y3HUKLgk6Sf1ZYv7fzbvW6o5Vod+t57f xKyPVoF+0Xn3VkbKWidmuQLgTS03sqVefKTX6skaTvVluhg4eBQowfgkGMRkhqoD LtPnc/u4bTM7T2YI4MBWflEo+Zclmx+6bL7DWAqAXsAVXFpADWH+skRHcklpoCZs 4uZ4jXwzjd1qglate5ETfjBSISSBv+DwwDROtTGiA/PZ5y8zQWPqaRzHWo9CO7l0 OJnEb6t305SypyLbFLcTGHLjDYYrZuFPrPE84pUVOA1sj4pvnNcQZibr0MxjBFwM uTuAWQoTqDI=UB93 -----END PGP SIGNATURE-------RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Protect your Red Hat Enterprise Linux 7.5 system by applying the latest ipmitool upgrades to mitigate serious security vulnerabilities. Take action today!. Red Hat Enterprise Linux, ipmitool, buffer overflow, security update, important advisory. . Severity: Important. LinuxSecurity.com Team

Apr 16, 2020 •Important Red Hat