Red Hat Bugzilla – Bug 1466359
CVE-2017-7480 rkhunter: File download via http might lead to RCE
Last modified: 2017-07-21 08:55:12 EDT
It was found that rkhunter download various files such as mirrors.dat by default over http using no signature and just a version verification. An attacker can inject a file with MITM which is then run in bash. This could lead to remote code execution.
Name: Michael Scherer (Red Hat)
Created rkhunter tracking bugs for this issue:
Affects: epel-all [bug 1466361]
Affects: fedora-all [bug 1466360]