ID de Prueba:	1.3.6.1.4.1.25623.1.0.62904
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2008:0193
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2008:0193. The lspp-eal4-config-ibm and capp-lspp-eal4-config-hp packages contain utilities and documentation for configuring a machine for the Controlled Access Protection Profile, or the Labeled Security Protection Profile. It was discovered that use of the 'capp-lspp-config' script results in the '/etc/pam.d/system-auth' file being set to world-writable. Authorized local users who have limited privileges could then exploit this to gain additional access, or to escalate their privileges. (CVE-2008-0884) This issue only affects users who have installed either of these packages from the Red Hat FTP site as their base system configuration kickstart script. New deployments using the lspp-eal4-config-ibm or capp-lspp-eal4-config-hp packages are advised to upgrade to these updated packages, which resolve this issue. Solution: For systems already deployed, the following command can be run as root to restore the permissions to a secure setting: chmod 0644 /etc/pam.d/system-auth Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2008-0193.html http://www.redhat.com/security/updates/classification/#important Risk factor : High CVSS Score: 6.9
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0884 1019740 http://securitytracker.com/id?1019740 28557 http://www.securityfocus.com/bid/28557 29642 http://secunia.com/advisories/29642 RHSA-2008:0193 http://rhn.redhat.com/errata/RHSA-2008-0193.html https://bugzilla.redhat.com/show_bug.cgi?id=435442 redhat-lsppeal4config-insecure-permissions(41584) https://exchange.xforce.ibmcloud.com/vulnerabilities/41584
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.