Fedora Local Security Checks : Fedora Core 13 FEDORA-2010-7613 (xar)

Vulnerability Search		Search 324607 CVE descriptions and 146377 test descriptions, access 10,000+ cross references.
	Tests CVE All

Test ID: 1.3.6.1.4.1.25623.1.0.67448

Category: Fedora Local Security Checks

Title: Fedora Core 13 FEDORA-2010-7613 (xar)

Summary: NOSUMMARY

Description: Description:
The remote host is missing an update to xar
announced via advisory FEDORA-2010-7613.

The XAR project aims to provide an easily extensible archive format. Important
design decisions include an easily extensible XML table of contents for random
access to archived files, storing the toc at the beginning of the archive to
allow for efficient handling of streamed archives, the ability to handle files
of arbitrarily large sizes, the ability to choose independent encodings for
individual files in the archive, the ability to store checksums for individual
files in both compressed and uncompressed form, and the ability to query the
table of content's rich meta-data.

Update Information:

This update fixes CVE-2010-0055, an issue where xar did not properly validate
package signatures, which allows attackers to have an unspecified impact via a
modified package.

References:

[ 1 ] Bug #570678 - CVE-2010-0055 xar: signature bypass vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=570678

Solution: Apply the appropriate updates.

This update can be installed with the yum update program. Use
su -c 'yum update xar' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.

https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2010-7613

Risk factor : Critical

CVSS Score:
10.0

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-0055
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXQ3NRRTC4A3F3GW2RQNATJHYDIRSCBS/

Copyright Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit.
To run a free test of this vulnerability against your system, register below.

Test ID:	1.3.6.1.4.1.25623.1.0.67448
Category:	Fedora Local Security Checks
Title:	Fedora Core 13 FEDORA-2010-7613 (xar)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to xar announced via advisory FEDORA-2010-7613. The XAR project aims to provide an easily extensible archive format. Important design decisions include an easily extensible XML table of contents for random access to archived files, storing the toc at the beginning of the archive to allow for efficient handling of streamed archives, the ability to handle files of arbitrarily large sizes, the ability to choose independent encodings for individual files in the archive, the ability to store checksums for individual files in both compressed and uncompressed form, and the ability to query the table of content's rich meta-data. Update Information: This update fixes CVE-2010-0055, an issue where xar did not properly validate package signatures, which allows attackers to have an unspecified impact via a modified package. References: [ 1 ] Bug #570678 - CVE-2010-0055 xar: signature bypass vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=570678 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update xar' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2010-7613 Risk factor : Critical CVSS Score: 10.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0055 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXQ3NRRTC4A3F3GW2RQNATJHYDIRSCBS/
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com