CVE-2013-6435

2014-12-1618:59:00

CWE-74

[email protected]

web.nvd.nist.gov

115

cve-2013-6435

rpm

race condition

remote code execution

nvd

vulnerability

7.6 High

AI Score

Confidence

High

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.091 Low

EPSS

Percentile

94.6%

JSON

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.

CPENameOperatorVersion
rpm:rpmrpmeq2.3.5
rpm:rpmrpmeq4.4.2.1
rpm:rpmrpmeq1.4.3
rpm:rpmrpmeq3.0.1
rpm:rpmrpmeq4.1
rpm:rpmrpmeq2.2.3.11
rpm:rpmrpmeq4.8.0
rpm:rpmrpmeq2.4.4
rpm:rpmrpmeq2.3.8
rpm:rpmrpmeq2.0.6

CPE	Name	Operator	Version
rpm:rpm	rpm	eq	2.3.5
rpm:rpm	rpm	eq	4.4.2.1
rpm:rpm	rpm	eq	1.4.3
rpm:rpm	rpm	eq	3.0.1
rpm:rpm	rpm	eq	4.1
rpm:rpm	rpm	eq	2.2.3.11
rpm:rpm	rpm	eq	4.8.0
rpm:rpm	rpm	eq	2.4.4
rpm:rpm	rpm	eq	2.3.8
rpm:rpm	rpm	eq	2.0.6