Scientific Linux Security Update : quota on SL5.x i386/x86_64

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was discovered that the rpc.rquotad service did not use
tcp_wrappers correctly. Certain hosts access rules defined in
'/etc/hosts.allow' and '/etc/hosts.deny' may not have been honored,
possibly allowing remote attackers to bypass intended access
restrictions. (CVE-2012-3417)

This update also fixes the following bugs :

- Prior to this update, values were not properly
transported via the remote procedure call (RPC) and
interpreted by the client when querying the quota usage
or limits for network-mounted file systems if the quota
values were 2^32 kilobytes or greater. As a consequence,
the client reported mangled values. This update modifies
the underlying code so that such values are correctly
interpreted by the client.

- Prior to this update, warnquota sent messages about
exceeded quota limits from a valid domain name if the
warnquota tool was enabled to send warning e-mails and
the superuser did not change the default warnquota
configuration. As a consequence, the recipient could
reply to invalid addresses. This update modifies the
default warnquota configuration to use the reserved
example.com. domain. Now, warnings about exceeded quota
limits are sent from the reserved domain that inform the
superuser to change to the correct value.

- Previously, quota utilities could not recognize the file
system as having quotas enabled and refused to operate
on it due to incorrect updating of /etc/mtab. This
update prefers /proc/mounts to get a list of file
systems with enabled quotas. Now, quota utilities
recognize file systems with enabled quotas as expected.

- Prior to this update, the setquota(8) tool on XFS file
systems failed to set disk limits to values greater than
2^31 kilobytes. This update modifies the integer
conversion in the setquota(8) tool to use a 64-bit
variable big enough to store such values.

See also :

http://www.nessus.org/u?62f5da24

Solution :

Update the affected quota and / or quota-debuginfo packages.

Risk factor :

Medium / CVSS Base Score : 4.0
(CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 63602 ()

Bugtraq ID:

CVE ID: CVE-2012-3417