|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200411-13] Portage, Gentoolkit: Temporary file vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Portage, Gentoolkit: Temporary file vulnerabilities
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200411-13
(Portage, Gentoolkit: Temporary file vulnerabilities)
dispatch-conf and qpkg use predictable filenames for temporary files.
Impact
A local attacker could create symbolic links in the temporary files
directory, pointing to a valid file somewhere on the filesystem. When an
affected script is called, this would result in the file to be overwritten
with the rights of the user running the dispatch-conf or qpkg, which could
be the root user.
Workaround
There is no known workaround at this time.
Solution:
All Portage users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/portage-2.0.51-r3"
All Gentoolkit users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-portage/gentoolkit-0.2.0_pre8-r1"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
