CVE-2013-6435

What it actually does

Race condition in RPM package installation allows remote attackers to execute arbitrary code by crafting an RPM whose payload extracts files to temporary locations before signature validation completes, enabling placement of files such as cron jobs in directories like /etc/cron.d.

Why it matters to the business

Attackers can achieve full system compromise on affected Linux systems using vulnerable RPM versions, resulting in unauthorized code execution, persistence mechanisms, and potential widespread disruption across package-managed environments with high ecosystem prevalence.

How an attack unfolds

An attacker creates a specially crafted RPM file containing malicious payloads that trigger extraction prior to signature checks; the victim or automated process installs the package, allowing the race window to install files that grant code execution, such as cron entries, without requiring authentication.

How to fix it

Upgrade RPM to a version that performs signature validation before any file extraction; apply all available security updates to affected distributions such as Debian Linux; where fixed versions are unavailable in legacy environments, isolate or replace affected systems.

How to confirm the fix worked

Verify RPM package version against known patched releases; attempt installation of test packages that exercise pre-validation extraction paths in a controlled environment; review package manager logs for any signature bypass indicators during installs.

Typical attack path

1. Craft malicious RPM package exploiting the pre-validation extraction race
2. Distribute the package via repositories, downloads, or supply-chain compromise
3. Induce target system to install the package using rpm or package managers
4. Exploit race condition to write attacker-controlled files to privileged locations
5. Achieve code execution or persistence via installed artifacts

How to detect it

Examine package installation logs for RPM operations involving unsigned or suspicious packages; search for unexpected files appearing in /etc/cron.d or temporary extraction directories during package installs; correlate with process execution of cron jobs or scripts not present in prior baselines.

• /etc/cron.d/* files created during RPM package extraction
• rpm process spawning unexpected child processes writing to system directories
• package manager logs showing extraction before signature verification

What your security team should do

• Immediately inventory all systems using RPM 4.11.1 or earlier and prioritize upgrades
• Monitor for any remaining legacy RPM deployments given the 4314 days since publication
• Implement strict package source validation and signature enforcement policies
• Review and harden cron and temporary file handling configurations across fleets