PCI Compliance Vulnerbilities

[pawelek]

We did a PCI compliance scan on our CentOS 5.10 and the following vulnerabilities showed up... are there any plans from CentOS to update the affected RPM's to address these vulnerabilities?

1.1.1. For portmapper
These vulnerabilities can be resolved by performing the following 5 steps. The total estimated time to perform all of these steps is 16
hours.

Upgrade librpcsecgss to 0.15.
Estimated time: 2 hours
Download and apply the upgrade from: http://www.citi.umich.edu/projects/nfsv ... rpcsecgss/
This will address 2 instances of the following issue: Kerberos "svcauth_gss_validate()" Buffer Overflow Vulnerability (kerberos-svc-authgss-
buffer-overflow).

Upgrade libtirpc to 0.1.8.
Estimated time: 2 hours
Download and apply the upgrade from: http://sourceforge.net/projects/libtirpc/files/
This will address 2 instances of the following issue: Kerberos "svcauth_gss_validate()" Buffer Overflow Vulnerability (kerberos-svc-authgss-
buffer-overflow).

Upgrade Kerberos 5 to 1.5.5.
Estimated time: 2 hours
Download and apply the upgrade from: http://web.mit.edu/Kerberos/krb5-1.5/
This will address 2 instances of the following issue: Kerberos "svcauth_gss_validate()" Buffer Overflow Vulnerability (kerberos-svc-authgss-
buffer-overflow).

Upgrade Kerberos 5 to 1.6.3.
Estimated time: 2 hours
Download and apply the upgrade from: http://web.mit.edu/Kerberos/krb5-1.6/
This will address 2 instances of the following issue: Kerberos "svcauth_gss_validate()" Buffer Overflow Vulnerability (kerberos-svc-authgss-
buffer-overflow).

Fix affected libraries
Estimated time: 8 hours
Upgrade libnsl, libc, glibc, dietlibc and any other affected libraries to the newest version.
This will address 2 instances of the following issue: "xdrmem_getbytes()" Integer Overflow Vulnerability (xdrmem-getbytes-integeroverflow).

[gerald_clark]

You can't go by version numbers.
http://wiki.centos.org/FAQ/General read item 23.

[TrevorH]

And in case it's not obvious... do not do any of those upgrades!

[Super Jamie]

Push your compliance scanner vendor to provide CVE numbers instead of meaningless garbage.

Check the relevant CVEs on the CVE database:

https://access.redhat.com/security/cve/