CVE-2013-6435

CVE Details

Release Date:	2014-12-09
Impact:	Important	What is this?

Description

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation.

See more information about CVE-2013-6435 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	7.6
Vector String:	AV:N/AC:H/Au:N/C:C/I:C/A:C
Version:	2.0
Attack Vector:	Network
Attack Complexity:	High
Authentication:	None
Confidentiality Impact:	Complete
Integrity Impact:	Complete
Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Linux version 5 (rpm)	ELSA-2014-1974	2014-12-09
Oracle Linux version 6 (rpm)	ELSA-2014-1974	2014-12-09
Oracle Linux version 7 (rpm)	ELSA-2014-1976	2014-12-09
Oracle VM version 3.2 (rpm)	OVMSA-2016-0077	2016-06-20
Oracle VM version 3.3 (rpm)	OVMSA-2014-0083	2014-12-10