Fedora 15 : PackageKit-0.6.15-2.fc15 (2011-8943)

Low Nessus Plugin ID 55500


The remote Fedora host is missing a security update.


- Upstream yum recently changed the behaviour when checking signatures on a package. The commit added a new configuration key which only affects local packages, but the key was set by default to False.

- This meant that an end user could install a local unsigned rpm package using PackageKit without a GPG trust check, and the user would be told the untrusted package is itself trusted.

- To exploit this low-impact vulnerability, a user would have to manually download an unsigned package file and would still be required to authenticate to install the package.

- The CVE-ID for this bug is CVE-2011-2515

- See https://bugzilla.redhat.com/show_bug.cgi?id=717566 for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected PackageKit package.

See Also




Plugin Details

Severity: Low

ID: 55500

File Name: fedora_2011-8943.nasl

Version: $Revision: 1.7 $

Type: local

Agent: unix

Published: 2011/07/05

Modified: 2015/10/20

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 1.5

Vector: CVSS2#AV:L/AC:M/Au:S/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:PackageKit, cpe:/o:fedoraproject:fedora:15

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2011/07/01

Reference Information

CVE: CVE-2011-2515

FEDORA: 2011-8943