It was discovered that yum-updatesd did not properly perform RPM package signature checks. When yum-updatesd was configured to automatically install updates, a remote attacker could use this flaw to install a malicious update on the target system using an unsigned RPM or an RPM signed with an untrusted key.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | yum | 2014-03-24 23:38 | ALAS-2014-315 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv2 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
NVD | CVSSv2 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |