SB2018101120 - Fedora 28 update for hesiod
Published: October 11, 2018 Updated: April 24, 2025
Security Bulletin ID
SB2018101120
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Configuration error (CVE-ID: CVE-2016-10152)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists in the read_config_file function in lib/hesiod. due to falling back to the ".athena.mit.edu" default domain when opening the configuration file fails. A remote attacker can poison the DNS cache and gain root privileges.
2) Configuration error (CVE-ID: CVE-2016-10151)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists in the hesiod_init function in lib/hesiod.c due to comparing EUID with UID to determine whether to use configurations from environment variables. A local attacker can gain root privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.
Remediation
Install update from vendor's website.