Issued:
2010-04-13
Updated:
2010-04-13

RHSA-2010:0347 - Security Advisory

Synopsis

Moderate: nss_db security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated nss_db packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The nss_db packages provide a set of C library extensions which allow
Berkeley Database (Berkeley DB) databases to be used as a primary source of
aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services,
and shadow passwords. These databases are used instead of or in addition to
the flat files used by these tools by default.

It was discovered that nss_db did not specify a path to the directory to be
used as the database environment for the Berkeley Database library, causing
it to use the current working directory as the default. This could possibly
allow a local attacker to obtain sensitive information. (CVE-2010-0826)

Users of nss_db are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 580187 - CVE-2010-0826 nss_db: Information leak due the DB_CONFIG file read from current working directory

Red Hat Enterprise Linux Server 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
ia64
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.ia64.rpm SHA-256: b665033b8dcb0523f637cd6ee33342b42b4aa0e983749e2e3c270d0b1442a5b1
i386
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux Workstation 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux Desktop 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
s390x
nss_db-2.2-35.4.el5_5.s390.rpm SHA-256: 4439753f7d77aaf9f8fd6bfa189abc3c739561280d095019d53b06e63d49db10
nss_db-2.2-35.4.el5_5.s390x.rpm SHA-256: dac6358d033ea035f7b8902966f7d477dd1c0493b44e162792b3d094d1e8f564

Red Hat Enterprise Linux for Power, big endian 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
ppc
nss_db-2.2-35.4.el5_5.ppc.rpm SHA-256: 0e72fad17955808a6ce65fade11f2818e2c4e7558195520d46fa6782ff812712
nss_db-2.2-35.4.el5_5.ppc64.rpm SHA-256: 387cc3e41a43e2ee7884e52cee721b4eb2d6fdc4523b97b04c1ba4f6eab2c400

Red Hat Enterprise Linux Server from RHUI 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.