Lucene search

[email protected]NVD:CVE-2010-2059

HistoryJun 08, 2010 - 6:30 p.m.

CVE-2010-2059

2010-06-0818:30:10

CWE-264

[email protected]

web.nvd.nist.gov

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.3%

JSON

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Affected configurations

NVD

Node

rpmrpmRange≤4.4.2.3

rpmrpmMatch1.2

rpmrpmMatch1.3

rpmrpmMatch1.3.1

rpmrpmMatch1.4

rpmrpmMatch1.4.2

rpmrpmMatch1.4.2\/a

rpmrpmMatch1.4.3

rpmrpmMatch1.4.4

rpmrpmMatch1.4.5

rpmrpmMatch1.4.6

rpmrpmMatch1.4.7

rpmrpmMatch2..4.10

rpmrpmMatch2.0

rpmrpmMatch2.0.1

rpmrpmMatch2.0.2

rpmrpmMatch2.0.3

rpmrpmMatch2.0.4

rpmrpmMatch2.0.5

rpmrpmMatch2.0.6

rpmrpmMatch2.0.7

rpmrpmMatch2.0.8

rpmrpmMatch2.0.9

rpmrpmMatch2.0.10

rpmrpmMatch2.0.11

rpmrpmMatch2.1

rpmrpmMatch2.1.1

rpmrpmMatch2.1.2

rpmrpmMatch2.2

rpmrpmMatch2.2.1

rpmrpmMatch2.2.2

rpmrpmMatch2.2.3

rpmrpmMatch2.2.3.10

rpmrpmMatch2.2.3.11

rpmrpmMatch2.2.4

rpmrpmMatch2.2.5

rpmrpmMatch2.2.6

rpmrpmMatch2.2.7

rpmrpmMatch2.2.8

rpmrpmMatch2.2.9

rpmrpmMatch2.2.10

rpmrpmMatch2.2.11

rpmrpmMatch2.3

rpmrpmMatch2.3.1

rpmrpmMatch2.3.2

rpmrpmMatch2.3.3

rpmrpmMatch2.3.4

rpmrpmMatch2.3.5

rpmrpmMatch2.3.6

rpmrpmMatch2.3.7

rpmrpmMatch2.3.8

rpmrpmMatch2.3.9

rpmrpmMatch2.4.1

rpmrpmMatch2.4.2

rpmrpmMatch2.4.3

rpmrpmMatch2.4.4

rpmrpmMatch2.4.5

rpmrpmMatch2.4.6

rpmrpmMatch2.4.8

rpmrpmMatch2.4.9

rpmrpmMatch2.4.11

rpmrpmMatch2.4.12

rpmrpmMatch2.5

rpmrpmMatch2.5.1

rpmrpmMatch2.5.2

rpmrpmMatch2.5.3

rpmrpmMatch2.5.4

rpmrpmMatch2.5.5

rpmrpmMatch2.5.6

rpmrpmMatch2.6.7

rpmrpmMatch3.0

rpmrpmMatch3.0.1

rpmrpmMatch3.0.2

rpmrpmMatch3.0.3

rpmrpmMatch3.0.4

rpmrpmMatch3.0.5

rpmrpmMatch3.0.6

rpmrpmMatch4.0.

rpmrpmMatch4.0.1

rpmrpmMatch4.0.2

rpmrpmMatch4.0.3

rpmrpmMatch4.0.4

rpmrpmMatch4.1

rpmrpmMatch4.3.3

rpmrpmMatch4.4.2

rpmrpmMatch4.4.2.1

rpmrpmMatch4.4.2.2

Node

rpmrpmMatch4.6.0

rpmrpmMatch4.6.1

rpmrpmMatch4.7.0

rpmrpmMatch4.7.1

rpmrpmMatch4.7.2

rpmrpmMatch4.8.0

References

distrib-coffee.ipsl.jussieu.fr/pub/mirrors/rpm/files/rpm/rpm-4.4/rpm-4.4.3.tar.gz

lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html

lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

lists.vmware.com/pipermail/security-announce/2011/000126.html

marc.info/?l=oss-security&m=127559059928131&w=2

rpm.org/gitweb?p=rpm.git%3Ba=commit%3Bh=ca2d6b2b484f1501eafdde02e1688409340d2383

secunia.com/advisories/40028

www.mandriva.com/security/advisories?name=MDVSA-2010:180

www.openwall.com/lists/oss-security/2010/06/02/2

www.openwall.com/lists/oss-security/2010/06/02/3

www.openwall.com/lists/oss-security/2010/06/03/5

www.openwall.com/lists/oss-security/2010/06/04/1

www.osvdb.org/65143

www.redhat.com/support/errata/RHSA-2010-0679.html

www.securityfocus.com/archive/1/516909/100/0/threaded

www.vmware.com/security/advisories/VMSA-2011-0004.html

www.vupen.com/english/advisories/2011/0606

bugzilla.redhat.com/show_bug.cgi?id=125517

bugzilla.redhat.com/show_bug.cgi?id=598775

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.3%

JSON

Related for NVD:CVE-2010-2059

oraclelinux2 nessus22 openvas21 cvelist5 centos2 debiancve5 ubuntucve4 cve5 redhat2 prion3 veracode1 nvd4 fedora2 securityvulns3 vmware4 gentoo1