[RHSA-2014:1004-01] Important: yum-updatesd security update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: yum-updatesd security update

Advisory ID: RHSA-2014:1004-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1004.html

Issue date: 2014-08-05

CVE Names: CVE-2014-0022

=====================================================================

 

1. Summary:

 

An updated yum-updatesd package that fixes one security issue is now

available for Red Hat Enterprise Linux 5.

 

The Red Hat Security Response Team has rated this update as having

Important security impact. A Common Vulnerability Scoring System (CVSS)

base score, which gives a detailed severity rating, is available from the

CVE link in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux (v. 5 server) - noarch

Red Hat Enterprise Linux Desktop (v. 5 client) - noarch

 

3. Description:

 

The yum-updatesd package provides a daemon which checks for available

updates and can notify you when they are available via email, syslog,

or dbus.

 

It was discovered that yum-updatesd did not properly perform RPM package

signature checks. When yum-updatesd was configured to automatically install

updates, a remote attacker could use this flaw to install a malicious

update on the target system using an unsigned RPM or an RPM signed with an

untrusted key. (CVE-2014-0022)

 

All yum-updatesd users are advised to upgrade to this updated package,

which contains a backported patch to correct this issue. After installing

this update, the yum-updatesd service will be restarted automatically.

 

4. Solution:

 

Before applying this update, make sure all previously released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to use the

Red Hat Network to apply this update are available at

https://access.redhat.com/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1057377 - CVE-2014-0022 yum: yum-cron installs unsigned packages

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 5 client):

 

Source:

yum-updatesd-0.9-6.el5_10.src.rpm

 

noarch:

yum-updatesd-0.9-6.el5_10.noarch.rpm

 

Red Hat Enterprise Linux (v. 5 server):

 

Source:

yum-updatesd-0.9-6.el5_10.src.rpm

 

noarch:

yum-updatesd-0.9-6.el5_10.noarch.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2014-0022.html

https://access.redhat.com/security/updates/classification/#important

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2014 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFT4FHSXlSAg2UNWIIRAkDGAJ9VMvVYr74qD8k30j3fYJAfw5I92gCfbL06

vrVTwBKj0j8tghF3XAZ7MF8=

=f4BT

-----END PGP SIGNATURE-----

 

 

--