Test ID:	1.3.6.1.4.1.25623.1.0.67381
Category:	Fedora Local Security Checks
Title:	Fedora Core 11 FEDORA-2010-6331 (nss_db)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to nss_db announced via advisory FEDORA-2010-6331. Update Information: Stephane Chazelas reported that the nss_db module attempts to read a DB_CONFIG file in the current directory when it is used. If the contents of the file can't be parsed properly, the copy of libdb which nss_db uses will print an error message. If nss_db is invoked from a setuid process, it may then expose privileged information to the unprivileged user who started the process. This update imports Kees Cook's fix for the issue (CVE-2010-0826). References: [ 1 ] Bug #580187 - CVE-2010-0826 nss_db: Information leak due the DB_CONFIG file read from current working directory https://bugzilla.redhat.com/show_bug.cgi?id=580187 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update nss_db' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-6331 Risk factor : Low CVSS Score: 1.9
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0826 BugTraq ID: 39132 http://www.securityfocus.com/bid/39132 http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038760.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:077 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10727 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6681 http://secunia.com/advisories/39165 http://www.ubuntu.com/usn/USN-922-1 http://www.vupen.com/english/advisories/2010/0776 http://www.vupen.com/english/advisories/2010/0841 http://www.vupen.com/english/advisories/2010/0903
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.