PT-2008-1127 · Conserver+1 · Conserver+1

Robin Johnson · Publicado 2008-03-18 · Atualizado 2017-08-08 · CVE-2008-1383

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gentoo Linux (affected versions not specified) conserver versions prior to 8.1.16

Description The issue affects Gentoo Linux and is related to the handling of SSL keys and certificates. Specifically, the docert function in ssl-cert.eclass stores the SSL key in a binpkg when used by src compile or src install, allowing local users to extract the key. This results in multiple systems using the same SSL key and certificate if they use this binpkg. Additionally, there is a vulnerability in the conserver package that can lead to a breach of protected information, and it can be exploited locally.

Recommendations For conserver versions prior to 8.1.16, update to version 8.1.16 or later. At the moment, there is no information about a newer version of Gentoo Linux that contains a fix for this vulnerability.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

BDU:2015-09633

CVE-2008-1383

Produtos afetados

Gentoo Linux

Conserver

Referências · 8

• http://securityfocus.com/bid/28350 · Nota
• http://security.gentoo.org/glsa/glsa-200803-30.xml · Aviso do Fabricante
• http://osvdb.org/43479 · Nota
• https://bdu.fstec.ru/vul/2015-09633 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-1383 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41336 · Nota
• http://secunia.com/advisories/29436 · Aviso do Fabricante
• https://bugs.gentoo.org/show_bug.cgi?id=174759 · Nota