PT-2008-1104 · Gentoo · Portage

Publicado 2008-10-09 · Atualizado 2017-08-08 · CVE-2008-4394

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Portage versions prior to 2.1.4.5

Description The issue concerns untrusted search path vulnerabilities in Portage, allowing local users to execute arbitrary code via modified Python modules loaded by various ebuilds, including ys-apps/portage, net-mail/fetchmail, and app-editors/leo. This vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information. It can be exploited locally.

Recommendations For versions prior to 2.1.4.5, update to version 2.1.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable ebuilds until a patch is applied. Avoid using the affected ebuilds in sensitive environments until the issue is resolved.

Correção

Identificadores relacionados

BDU:2015-09360

CVE-2008-4394

Produtos afetados

Portage

Referências · 6

• http://security.gentoo.org/glsa/glsa-200810-02.xml · Aviso do Fabricante
• http://securityfocus.com/bid/31670 · Nota
• https://bdu.fstec.ru/vul/2015-09360 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45792 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4394 · Nota de Segurança
• http://secunia.com/advisories/32228 · Aviso do Fabricante