PT-2007-1123 · Gentoo · Portage

Publicado 2007-12-13 · Atualizado 2017-08-08 · CVE-2007-6249

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Portage versions prior to 2.1.3.11

Description: The issue concerns a problem where the permissions for the merge file are set based on the umask, often resulting in weaker permissions than those of the original files. This could allow local users to obtain sensitive information by reading the merge file. The exploitation of this issue can be done locally and may lead to the compromise of protected information.

Recommendations: For versions prior to 2.1.3.11, update to version 2.1.3.11 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-09614

CVE-2007-6249

Produtos afetados

Portage

Referências · 11

• 🔥 http://sources.gentoo.org/viewcvs.py/portage?rev=7799&view=rev · Exploit
• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=193589 · Exploit
• http://securitytracker.com/id?1019097 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39035 · Nota
• https://bdu.fstec.ru/vul/2015-09614 · Nota de Segurança
• http://secunia.com/advisories/28094 · Nota
• http://security.gentoo.org/glsa/glsa-200712-11.xml · Nota
• http://securityfocus.com/bid/26864 · Nota
• http://gentoo.org/security/en/glsa/glsa-200712-11.xml · Aviso do Fabricante
• http://osvdb.org/42636 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6249 · Nota de Segurança