CVE-2013-6435

CVE Details

Release Date:

2014-12-09

Description

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation.

See more information about CVE-2013-6435 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	7.6	Base Metrics:	AV:N/AC:H/Au:N/C:C/I:C/A:C
Access Vector:	Network	Attack Complexity:	High
Authentication:	None required	Confidentiality Impact:	Complete
Integrity Impact:	Complete	Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Linux version 5 (rpm)	ELSA-2014-1974	2014-12-09
Oracle Linux version 6 (rpm)	ELSA-2014-1974	2014-12-09
Oracle Linux version 7 (rpm)	ELSA-2014-1976	2014-12-09
Oracle VM version 3.2 (rpm)	OVMSA-2016-0077	2016-06-20
Oracle VM version 3.3 (rpm)	OVMSA-2014-0083	2014-12-10

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team