PT-2007-1085 · Gentoo+1 · Gentoo Linux+1

Published 2007-03-18 · Updated 2017-07-29 · CVE-2007-1500

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Linux Security Auditing Tool (LSAT) versions prior to 0.9.5 Gentoo Linux lsat package versions prior to 0.9.5

Description: The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files. This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally by an authenticated attacker.

Recommendations: For LSAT versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. For Gentoo Linux lsat package versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue.

Fix

Related Identifiers

BDU:2015-09559

CVE-2007-1500

Affected Products

Gentoo Linux

Lsat

References · 8

• http://security.gentoo.org/glsa/glsa-200703-20.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-1500 · Security Note
• http://secunia.com/advisories/24526 · Vendor Advisory
• http://osvdb.org/34267 · Note
• http://securityfocus.com/bid/23014 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=159542 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33057 · Note