Test ID:	1.3.6.1.4.1.25623.1.0.67908
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2010:0679
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory RHSA-2010:0679. The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded by a system administrator. This could have security implications if a package was upgraded because of a security flaw in a setuid or setgid program. (CVE-2010-2059) Solution: All users of rpm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2010-0679.html http://www.redhat.com/security/updates/classification/#moderate Risk factor : High CVSS Score: 7.2
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2059 Bugtraq: 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. (Google Search) http://www.securityfocus.com/archive/1/516909/100/0/threaded http://www.mandriva.com/security/advisories?name=MDVSA-2010:180 http://www.openwall.com/lists/oss-security/2010/06/02/2 http://www.openwall.com/lists/oss-security/2010/06/02/3 http://marc.info/?l=oss-security&m=127559059928131&w=2 http://www.openwall.com/lists/oss-security/2010/06/03/5 http://www.openwall.com/lists/oss-security/2010/06/04/1 http://lists.vmware.com/pipermail/security-announce/2011/000126.html http://www.osvdb.org/65143 http://www.redhat.com/support/errata/RHSA-2010-0679.html http://secunia.com/advisories/40028 SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html SuSE Security Announcement: SUSE-SR:2010:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://www.vupen.com/english/advisories/2011/0606
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.