Synopsis

Moderate: nss_db security update

Type/Severity

Security Advisory: Moderate

Topic

Updated nss_db packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The nss_db packages provide a set of C library extensions which allow
Berkeley Database (Berkeley DB) databases to be used as a primary source of
aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services,
and shadow passwords. These databases are used instead of or in addition to
the flat files used by these tools by default.

It was discovered that nss_db did not specify a path to the directory to be
used as the database environment for the Berkeley Database library, causing
it to use the current working directory as the default. This could possibly
allow a local attacker to obtain sensitive information. (CVE-2010-0826)

Users of nss_db are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 580187 - CVE-2010-0826 nss_db: Information leak due the DB_CONFIG file read from current working directory

CVEs

• CVE-2010-0826

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm	SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
ia64
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.ia64.rpm	SHA-256: b665033b8dcb0523f637cd6ee33342b42b4aa0e983749e2e3c270d0b1442a5b1
i386
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux Workstation 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm	SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux Desktop 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm	SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
s390x
nss_db-2.2-35.4.el5_5.s390.rpm	SHA-256: 4439753f7d77aaf9f8fd6bfa189abc3c739561280d095019d53b06e63d49db10
nss_db-2.2-35.4.el5_5.s390x.rpm	SHA-256: dac6358d033ea035f7b8902966f7d477dd1c0493b44e162792b3d094d1e8f564

Red Hat Enterprise Linux for Power, big endian 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
ppc
nss_db-2.2-35.4.el5_5.ppc.rpm	SHA-256: 0e72fad17955808a6ce65fade11f2818e2c4e7558195520d46fa6782ff812712
nss_db-2.2-35.4.el5_5.ppc64.rpm	SHA-256: 387cc3e41a43e2ee7884e52cee721b4eb2d6fdc4523b97b04c1ba4f6eab2c400

Red Hat Enterprise Linux Server from RHUI 5

SRPM
nss_db-2.2-35.4.el5_5.src.rpm	SHA-256: 4bd28d27db366e5cb6ac377688c64270a738817852c9524f5f29b42fbfce5e9c
x86_64
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901
nss_db-2.2-35.4.el5_5.x86_64.rpm	SHA-256: 0a955b9f1177f0ef490c88de2bdd6d425c4c0f2da4cbd7d74b80583b2cb7346a
i386
nss_db-2.2-35.4.el5_5.i386.rpm	SHA-256: daf88a84b601c0ab549f1d26f3bf54056b09704e9b8cb8aafe52ace5c98fa901