trousers-0.3.15-1.el8
エラータID: AXSA:2021-1817:01
リリース日:
2021/06/08 Tuesday - 03:27
題名:
trousers-0.3.15-1.el8
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- TrouSerS には tcsd デーモンを tss ユーザーではなく root 権限で起動した場合、
不要になった root の gid 権限の削除ができない脆弱性があります。(CVE-2020-24330)
- TrouSerS にはtcsd デーモンを root 権限で起動した場合、tss ユーザーが引き続き、
デーモンに関する様々な設定が含まれている /etc/tcsd.conf ファイルへの
リード/ライトアクセスできてしまう脆弱性があります。(CVE-2020-24331)
- TrouSerS には tcsd デーモンを root 権限で起動した場合、system.data ファイルの作成を行う際に
シンボリックリンク攻撃を受けやすくなり、tss ユーザを使って既存ファイルを破損、
もしくは強制的に上書きすることができるため、サービス拒否攻撃を招く可能性のある
脆弱性があります。(CVE-2020-24332)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2020-24330
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
CVE-2020-24331
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
CVE-2020-24332
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
追加情報:
N/A
ダウンロード:
SRPMS
- trousers-0.3.15-1.el8.src.rpm
MD5: 417875bf5e62be73b22943df9ae2bef9
SHA-256: d29bbe76353a30095330466939d5570e06a5fa4e89211ec7a26f26f5bab85a1d
Size: 4.50 MB
Asianux Server 8 for x86_64
- trousers-0.3.15-1.el8.x86_64.rpm
MD5: 300a42990c315b562b0b27b422f4e88c
SHA-256: ee34a0f4d184d727ffa1ad6bd59323facaefb2f77d75158fb7c43b359f0b6bff
Size: 151.42 kB - trousers-lib-0.3.15-1.el8.x86_64.rpm
MD5: f5ae254edd33480ba75a0e1d1ec69a31
SHA-256: ca969e146e61bc5ac723dfce529fc53fdae756e105229a04e5fd5e0da4b96cde
Size: 166.46 kB - trousers-lib-0.3.15-1.el8.i686.rpm
MD5: ec798326514f02353146943ef952451b
SHA-256: eaa9e986964d84fc148fa7ace69380d1a31314f6dc2ef44d039d14dd7267b99a
Size: 187.41 kB
English