|Category:||Red Hat Local Security Checks|
|Title:||RedHat Security Advisory RHSA-2007:0631|
The remote host is missing updates announced in
coolkey contains the driver support for the CoolKey and Common Access Card
(CAC) Smart Card products. The CAC is used by the U.S. Government.
Steve Grubb discovered a flaw in the way coolkey created a temporary
directory. A local attacker could perform a symlink attack and cause
arbitrary files to be overwritten. (CVE-2007-4129)
In addition, the updated packages contain fixes for the following bugs in
the CAC Smart Card support:
* CAC Smart Cards can have from 1 to 3 certificates. The coolkey driver,
however, was not recognizing cards if they had less than 3 certificates.
* logging into a CAC Smart Card token with a new application would cause
other, already authenticated, applications to lose their login status
unless the Smart Card was then removed from the reader and re-inserted.
All CAC users should upgrade to these updated packages, which resolve these
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
Risk factor : Medium
Common Vulnerability Exposure (CVE) ID: CVE-2007-4129|
BugTraq ID: 26369
XForce ISS Database: coolkey-pk11ipc1-symlink(38330)
|Copyright||Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com|
|This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.