RPM Package Manager Signature Verification Insufficient User Feedback Weakness
BID:5594
Info
RPM Package Manager Signature Verification Insufficient User Feedback Weakness
| Bugtraq ID: | 5594 |
| Class: | Environment Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2002 12:00AM |
| Updated: | Aug 29 2002 12:00AM |
| Credit: | Published by Andrew Griffiths <[email protected]>. |
| Vulnerable: |
Redhat RPM 4.0.4 Redhat RPM 4.0.3 Redhat RPM 4.0.2 -7x |
| Not Vulnerable: | |
Discussion
RPM Package Manager Signature Verification Insufficient User Feedback Weakness
The RPM Package Manager is a command line utility for creating, installing and managing RPM packages. It is available for a wide range of Linux systems. The rpm standard includes support for cryptographic signing of packages.
A weakness in the interface of the rpm command may allow packages signed by malicious parties to escape the attention of the user verifying signatures. By default, the '--checksig' command will only verify that the signature is valid for some party trusted by the end user. Information on who has signed the package is not displayed.
Detailed feedback is displayed if rpm is invoked with the '-v' or '-vv' flag.
The RPM Package Manager is a command line utility for creating, installing and managing RPM packages. It is available for a wide range of Linux systems. The rpm standard includes support for cryptographic signing of packages.
A weakness in the interface of the rpm command may allow packages signed by malicious parties to escape the attention of the user verifying signatures. By default, the '--checksig' command will only verify that the signature is valid for some party trusted by the end user. Information on who has signed the package is not displayed.
Detailed feedback is displayed if rpm is invoked with the '-v' or '-vv' flag.
Exploit / POC
RPM Package Manager Signature Verification Insufficient User Feedback Weakness
No exploit is required. A large degree of social engineering and user interaction is, however, neccessary.
No exploit is required. A large degree of social engineering and user interaction is, however, neccessary.
Solution / Fix
RPM Package Manager Signature Verification Insufficient User Feedback Weakness
Solution:
By passing either '-v' or '-vv' to the rpm utility, detailed signature information will be displayed.
Reportedly, the default behavior of the '-checksig' flag will be modified in RPM 4.1. Version 4.1 is currently under development.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
By passing either '-v' or '-vv' to the rpm utility, detailed signature information will be displayed.
Reportedly, the default behavior of the '-checksig' flag will be modified in RPM 4.1. Version 4.1 is currently under development.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
RPM Package Manager Signature Verification Insufficient User Feedback Weakness
References:
References:
- RPM Homepage (RPM)