-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: yum-updatesd security update
Advisory ID:       RHSA-2014:1004-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-1004.html
Issue date:        2014-08-05
CVE Names:         CVE-2014-0022 
=====================================================================

1. Summary:

An updated yum-updatesd package that fixes one security issue is now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
Important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - noarch
Red Hat Enterprise Linux Desktop (v. 5 client) - noarch

3. Description:

The yum-updatesd package provides a daemon which checks for available
updates and can notify you when they are available via email, syslog,
or dbus.

It was discovered that yum-updatesd did not properly perform RPM package
signature checks. When yum-updatesd was configured to automatically install
updates, a remote attacker could use this flaw to install a malicious
update on the target system using an unsigned RPM or an RPM signed with an
untrusted key. (CVE-2014-0022)

All yum-updatesd users are advised to upgrade to this updated package,
which contains a backported patch to correct this issue. After installing
this update, the yum-updatesd service will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1057377 - CVE-2014-0022 yum: yum-cron installs unsigned packages

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
yum-updatesd-0.9-6.el5_10.src.rpm

noarch:
yum-updatesd-0.9-6.el5_10.noarch.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
yum-updatesd-0.9-6.el5_10.src.rpm

noarch:
yum-updatesd-0.9-6.el5_10.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2014-0022.html
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFT4FHSXlSAg2UNWIIRAkDGAJ9VMvVYr74qD8k30j3fYJAfw5I92gCfbL06
vrVTwBKj0j8tghF3XAZ7MF8=
=f4BT
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce