The remote host is affected by the vulnerability described in GLSA-201206-26 (RPM: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in RPM:
      fsm.c fails to properly strip setuid and setgid bits from executable         files during a package upgrade (CVE-2010-2059).
      RPM does not properly parse spec files (CVE-2010-2197).
      fsm.c fails to properly strip POSIX file capabilities from executable         files during a package upgrade or removal (CVE-2010-2198).
      fsm.c fails to properly strip POSIX ACLs from executable files during         a package upgrade or removal (CVE-2010-2199).
      header.c does not properly parse region offsets in package files         (CVE-2011-3378).
      RPM does not properly sanitize region tags in package headers         (CVE-2012-0060).
      RPM does not properly sanitize region sizes in package headers         (CVE-2012-0061).
      RPM does not properly sanitize region offsets in package         headers(CVE-2012-0815).
  Impact :

    A local attacker may be able to gain elevated privileges. Furthermore, a       remote attacker could entice a user to open a specially crafted RPM       package, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded by a system administrator. This could have security implications if a package was upgraded because of a security flaw in a setuid or setgid program.
(CVE-2010-2059)

This update also fixes the following bug :

  - A memory leak in the communication between RPM and the     Security-Enhanced Linux (SELinux) subsystem, which could     have caused extensive memory consumption. In reported     cases, this issue was triggered by running rhn_check     when errata were scheduled to be applied. (BZ#627630)

This update fixes the problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059)

Also following bugfixes were merged from SLE11 :

  - make 'rpmconfigcheck status' exit with 4 [bnc#592269]

  - do not use glibc for passwd/group lookups when --root is     used [bnc#536256]

  - disable cpio md5 checking for repackaged rpms     [bnc#572280]

  - Add rpm-4.4.2.3-no-order-rescan-limit.patch from     upstream (bnc#552622)

  - backport lazy statfs patch [fate#302038]

  - define disttag as optional tag with macro just like     disturl 

  - add popt-devel and rpm-devel to baselibs config     (bnc#445037)

  - brp-symlink: whitelist kde4 doc path (bnc#457908) 

  - find-supplements.ksyms: Module aliases may contain     special characters that rpm does not allow in     dependencies, such as commas. Encode those as %XX to     avoid generating broken dependencies (bnc#456695).

  - find-debuginfo.sh: Don't convert to binary.

This is a re-release of the previous rpm security update with corrected %version-%release information.

This update fixes a security problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059)

Additionally, a bug verifying RSAv4 signatures which marked all RSAv4 signatures as invalid has been fixed.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including arbitrary code execution vulnerabilities, in several third-party components and libraries :

  - bind
  - pam
  - popt
  - rpm
  - rpm-libs
  - rpm-python
  - Service Location Protocol daemon (SLPD)

- Wed Jun 30 2010 Panu Matilainen <pmatilai at redhat.com>
    - 4.7.2-2

    - Fix CVE-2010-2059 (#598775) and CVE-2010-2198       (#601955)

    - Tue Dec 8 2009 Panu Matilainen <pmatilai at       redhat.com> - 4.7.2-1

    - update to 4.7.2 (http://rpm.org/wiki/Releases/4.7.2)

    - fix posix chmod test to unbreak %fixperms macro       (#543035)

    - avoid looking into OpenPGP subkeys (#436812)

    - dont fail build on unrecognized non-executable files       (#532489)

    - fix password check result when gpg is missing       (#496754)

    - permit python to handle 64bit integer types from       headers

    - all header integer types are unsigned, match this in       python too

    - return python long objects where ints are not       sufficient (#531243)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Jun 30 2010 Panu Matilainen <pmatilai at redhat.com>
    - 4.8.1-2

    - plug a tiny race on sbit/capability removal

    - Mon Jun 14 2010 Panu Matilainen <pmatilai at       redhat.com> - 4.8.1-1

    - update to 4.8.1 (http://rpm.org/wiki/Releases/4.8.1)

    - drop no longer needed patches

    - fix source url pointing to testing directory

    - fixes CVE-2010-2059 / #598934

    - fixes #532992, #578299, #587755, #590588, #593553,       #597835, #598988

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated rpm packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading or removing packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded or removed by a system administrator. This could have security implications if a package was upgraded or removed because of a security flaw in a setuid or setgid program. (CVE-2005-4889, CVE-2010-2059)

All users of rpm are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

Updated rpm packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded by a system administrator. This could have security implications if a package was upgraded because of a security flaw in a setuid or setgid program.
(CVE-2010-2059)

This update also fixes the following bug :

* A memory leak in the communication between RPM and the Security-Enhanced Linux (SELinux) subsystem, which could have caused extensive memory consumption. In reported cases, this issue was triggered by running rhn_check when errata were scheduled to be applied. (BZ#627630)

All users of rpm are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

A vulnerability has been found and corrected in rpm :

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file (CVE-2010-2059).

The updated packages have been patched to correct this issue.

This update fixes a security problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059)

Also the following bugs were fixed :

  - make 'rpmconfigcheck status' exit with 4 [bnc#592269]

  - do not use glibc for passwd/group lookups when --root is     used [bnc#536256]

  - disable cpio md5 checking for repackaged rpms     [bnc#572280]

  - Add rpm-4.4.2.3-no-order-rescan-limit.patch from     upstream. (bnc#552622)

  - backport lazy statfs patch [fate#302038]

  - findksyms.diff: backport changes from Factory for     fate#305945.

  - fix v4 rsa signature verification code [bnc#615409]

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

From Red Hat Security Advisory 2010:0678 :

Updated rpm packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading or removing packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded or removed by a system administrator. This could have security implications if a package was upgraded or removed because of a security flaw in a setuid or setgid program. (CVE-2005-4889, CVE-2010-2059)

All users of rpm are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
59679	GLSA-201206-26 : RPM: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	high
60852	Scientific Linux Security Update : rpm on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
49265	openSUSE Security Update : popt (openSUSE-SU-2010:0629-1)	Nessus	SuSE Local Security Checks	2010/9/17	2021/1/14	high
51631	SuSE 11.1 Security Update : rpm (SAT Patch Number 3678)	Nessus	SuSE Local Security Checks	2011/1/21	2021/1/14	high
89675	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0004) (remote check)	Nessus	Misc.	2016/3/4	2021/1/6	high
47611	Fedora 12 : rpm-4.7.2-2.fc12 (2010-10617)	Nessus	Fedora Local Security Checks	2010/7/7	2021/1/11	high
47676	Fedora 13 : rpm-4.8.1-2.fc13 (2010-9829)	Nessus	Fedora Local Security Checks	2010/7/8	2021/1/11	high
49130	RHEL 4 : rpm (RHSA-2010:0678)	Nessus	Red Hat Local Security Checks	2010/9/8	2021/1/14	high
49131	RHEL 5 : rpm (RHSA-2010:0679)	Nessus	Red Hat Local Security Checks	2010/9/8	2021/1/14	high
49180	CentOS 4 : rpm (CESA-2010:0678)	Nessus	CentOS Local Security Checks	2010/9/12	2021/1/4	high
49209	Mandriva Linux Security Advisory : rpm (MDVSA-2010:180)	Nessus	Mandriva Local Security Checks	2010/9/13	2021/1/6	high
50957	SuSE 11 / 11.1 Security Update : popt (SAT Patch Numbers 2647 / 2648)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	high
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	2012/1/31	2021/1/6	high
68095	Oracle Linux 4 : rpm (ELSA-2010-0678)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high