PT-2007-6285 · Rmake · Rmake

Publicado 2007-10-04 · Atualizado 2018-10-15 · CVE-2007-5194

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rMake version 1.0.11

Description The issue concerns the Chroot server in rMake, which creates a /dev/zero device file with read/write permissions for the rMake user and the same minor device number as /dev/port. This might allow local users to gain root privileges.

Recommendations For rMake version 1.0.11, consider restricting access to the /dev/zero device file to prevent local users from exploiting this issue. As a temporary workaround, review and adjust the permissions of the /dev/zero device file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-5194

Produtos afetados

Rmake

Referências · 6

• https://issues.rpath.com/browse/RMK-634 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5194 · Nota de Segurança
• http://securityfocus.com/archive/1/481395/100/0/threaded · Nota
• http://securityfocus.com/bid/25899 · Nota
• https://bugs.gentoo.org/show_bug.cgi?id=194550 · Nota
• http://secunia.com/advisories/27030 · Nota