oss-security - Two rpm flaws

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5486F2E6.6020803@redhat.com>
Date: Tue, 09 Dec 2014 18:32:30 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Two rpm flaws

Two flaws in RPM (actually one of them is in cpio, which is embedded 
into RPM) was found by Florian Weimer of Red Hat Product Security.
Details as follows:

CVE-2013-6435:
It was found that RPM wrote file contents to the target installation 
directory under a temporary name, and verified its cryptographic 
signature only after the temporary file has been written completely. 
Under certain conditions, the system interprets the unverified temporary 
file contents and extracts commands from it. This could allow an 
attacker to modify signed RPM files in such a way that they would 
execute code chosen by the attacker during package installation.

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1039811

CVE-2014-8118:
It was found that RPM could encounter an integer overflow, leading to a 
stack-based overflow, while parsing a crafted CPIO header in the payload 
section of an RPM file.  This could allow an attacker to modify signed 
RPM files in such a way that they would execute code chosen by the 
attacker during package installation.

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1168715

-- 
Huzaifa Sidhpurwala / Red Hat Product Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.