Fedora 15 : PackageKit-0.6.15-2.fc15 (2011-8943)

low Nessus Plugin ID 55500

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

- Upstream yum recently changed the behaviour when checking signatures on a package. The commit added a new configuration key which only affects local packages, but the key was set by default to False.

- This meant that an end user could install a local unsigned rpm package using PackageKit without a GPG trust check, and the user would be told the untrusted package is itself trusted.

- To exploit this low-impact vulnerability, a user would have to manually download an unsigned package file and would still be required to authenticate to install the package.

- The CVE-ID for this bug is CVE-2011-2515

- See https://bugzilla.redhat.com/show_bug.cgi?id=717566 for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected PackageKit package.

Plugin Details

Severity: Low

ID: 55500

File Name: fedora_2011-8943.nasl

Version: 1.9

Type: local

Agent: unix

Family: Fedora Local Security Checks

Published: 7/5/2011

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Low

Base Score: 1.5

Vector: CVSS2#AV:L/AC:M/Au:S/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:15, p-cpe:/a:fedoraproject:fedora:packagekit

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 7/1/2011

Reference Information

CVE: CVE-2011-2515

FEDORA: 2011-8943

Detections

Analytics