Updated packages that fix multiple security issues and rebase various components are now available for Red Hat Certificate System 7.3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Red Hat Certificate System (RHCS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. Multiple buffer overflow flaws were discovered in the way the pcscd daemon, a resource manager that coordinates communications with smart card readers and smart cards connected to the system, handled client requests. A local user could create a specially-crafted request that would cause the pcscd daemon to crash or, possibly, execute arbitrary code. (CVE-2010-0407, CVE-2009-4901) This erratum updates the Tomcat component shipped as part of Red Hat Certificate System to version 5.5.23, to address multiple security issues. In a typical operating environment, Tomcat is not exposed to users of Certificate System in a vulnerable manner. These security updates will reduce risk in unique Certificate System environments. (CVE-2005-2090, CVE-2005-3510, CVE-2006-3835, CVE-2007-0450, CVE-2007-1358, CVE-2007-3382, CVE-2007-3385, CVE-2007-5461, CVE-2007-5333, CVE-2008-0128, CVE-2008-1232, CVE-2008-2370, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580) This erratum provides updated versions of the following components, required by the updated Tomcat version: ant, avalon-logkit, axis, classpathx-jaf, classpathx-mail, geronimo-specs, jakarta-commons-modeler, log4j, mx4j, xerces-j2, and xml-commons. A number of components have been updated to fix security issues for users of Red Hat Certificate System for the Solaris operating system. These fixes are for apr issue CVE-2009-2412; apr-util issues CVE-2009-0023, CVE-2009-1955, CVE-2009-1956, and CVE-2009-2412; httpd issues CVE-2006-3918, CVE-2006-5752, CVE-2007-1863, CVE-2007-3304, CVE-2007-3847, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005, CVE-2008-2364, CVE-2008-2939, CVE-2009-1891, CVE-2009-3094, CVE-2009-3095, and CVE-2010-0434; mod_perl issue CVE-2007-1349; and perl issues CVE-2007-5116 and CVE-2008-1927. Note: Updated apr, apr-util, httpd, mod_perl, and perl packages were previously available to users of Red Hat Certificate System for Red Hat Enterprise Linux via the Red Hat Enterprise Linux 4 channels on the Red Hat Network. Additionally, the rhpki-ca, rhpki-kra, rhpki-ocsp, rhpki-tks, rhpki-java-tools, and rhpki-native-tools packages were updated to address some anomalous behavior on the Solaris operating system. (BZ#600513, BZ#605760) As well, this update provides an updated rhpki-manage package, which includes installation and uninstall scripts for Red Hat Certificate System that have been updated with the list of packages required by the Tomcat component, and an updated dependency on the NSS and NSPR packages. All users of Red Hat Certificate System are advised to upgrade to these updated packages, which correct these issues. Refer to the Red Hat Certificate System Administration Guide, linked to in the References, for details on how to install the updated packages on the Solaris operating system. After installing this update, all Red Hat Certificate System subsystems must be restarted ("/etc/init.d/[instance-name] restart") for the update to take effect.