Test ID:	1.3.6.1.4.1.25623.1.0.880603
Category:	CentOS Local Security Checks
Title:	CentOS Update for popt CESA-2010:0679 centos5 i386
Summary:	The remote host is missing an update for the 'popt'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'popt' package(s) announced via the referenced advisory. Vulnerability Insight: The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded by a system administrator. This could have security implications if a package was upgraded because of a security flaw in a setuid or setgid program. (CVE-2010-2059) This update also fixes the following bug: * A memory leak in the communication between RPM and the Security-Enhanced Linux (SELinux) subsystem, which could have caused extensive memory consumption. In reported cases, this issue was triggered by running rhn_check when errata were scheduled to be applied. (BZ#627630) All users of rpm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Affected Software/OS: popt on CentOS 5 Solution: Please install the updated packages. CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2059 Bugtraq: 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. (Google Search) http://www.securityfocus.com/archive/1/516909/100/0/threaded http://www.mandriva.com/security/advisories?name=MDVSA-2010:180 http://www.openwall.com/lists/oss-security/2010/06/02/2 http://www.openwall.com/lists/oss-security/2010/06/02/3 http://marc.info/?l=oss-security&m=127559059928131&w=2 http://www.openwall.com/lists/oss-security/2010/06/03/5 http://www.openwall.com/lists/oss-security/2010/06/04/1 http://lists.vmware.com/pipermail/security-announce/2011/000126.html http://www.osvdb.org/65143 http://www.redhat.com/support/errata/RHSA-2010-0679.html http://secunia.com/advisories/40028 SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html SuSE Security Announcement: SUSE-SR:2010:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://www.vupen.com/english/advisories/2011/0606
Copyright	Copyright (c) 2011 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.