| Vulnerability Name: | CVE-2003-0546 (CCN-12855) | ||||||||
| Assigned: | 2003-08-08 | ||||||||
| Published: | 2003-08-08 | ||||||||
| Updated: | 2017-10-11 | ||||||||
| Summary: | up2date 3.0.7 and 3.1.23 does not properly verify RPM GPG signatures, which could allow remote attackers to cause unsigned packages to be installed from the Red Hat Network, if that network is compromised. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2003-0546 Source: REDHAT Type: UNKNOWN RHSA-2003:255 Source: CCN Type: RHSA-2003-255 up2date improperly checks GPG signature of packages Source: CCN Type: OSVDB ID: 12018 Red Hat Linux up2date RPM GPG Signature Verification Weakness Source: CCN Type: BID-8372 Red Hat Linux Up2Date GPG Signature Validation Vulnerability Source: XF Type: UNKNOWN up2date-gpg-automatic-install(12855) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:631 | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||