SCIENTIFIC-LINUX-ERRATA Archives

November 2007

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA for coolkey on SL5.x i386/x86_64
From:
Troy Dawson <[log in to unmask]>
Reply To:
Troy Dawson <[log in to unmask]>
Date:
Tue, 13 Nov 2007 16:46:49 -0600
Content-Type:
text/plain
Parts/Attachments:
text/plain (34 lines) 
Synopsis:	Low: coolkey security and bug fix update
Issue date:	2007-11-07
CVE Names:	CVE-2007-4129

Steve Grubb discovered a flaw in the way coolkey created a temporary
directory. A local attacker could perform a symlink attack and cause
arbitrary files to be overwritten. (CVE-2007-4129)

In addition, the updated packages contain fixes for the following bugs 
in the CAC Smart Card support:

* CAC Smart Cards can have from 1 to 3 certificates. The coolkey driver,
however, was not recognizing cards if they had less than 3 certificates.

* logging into a CAC Smart Card token with a new application would cause
other, already authenticated, applications to lose their login status
unless the Smart Card was then removed from the reader and re-inserted

SL 5.x

   SRPMS:
coolkey-1.1.0-5.el5.src.rpm
   i386:
coolkey-1.1.0-5.el5.i386.rpm
coolkey-devel-1.1.0-5.el5.i386.rpm
   x86_64:
coolkey-1.1.0-5.el5.i386.rpm
coolkey-1.1.0-5.el5.x86_64.rpm
coolkey-devel-1.1.0-5.el5.i386.rpm
coolkey-devel-1.1.0-5.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson

ATOM RSS1 RSS2