PT-2007-1123 · Gentoo · Portage

Published 2007-12-13 · Updated 2017-08-08 · CVE-2007-6249

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Portage versions prior to 2.1.3.11

Description: The issue concerns a problem where the permissions for the merge file are set based on the umask, often resulting in weaker permissions than those of the original files. This could allow local users to obtain sensitive information by reading the merge file. The exploitation of this issue can be done locally and may lead to the compromise of protected information.

Recommendations: For versions prior to 2.1.3.11, update to version 2.1.3.11 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-09614

CVE-2007-6249

Affected Products

Portage

References · 11

• 🔥 http://sources.gentoo.org/viewcvs.py/portage?rev=7799&view=rev · Exploit
• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=193589 · Exploit
• https://bdu.fstec.ru/vul/2015-09614 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200712-11.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6249 · Security Note
• http://securitytracker.com/id?1019097 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39035 · Note
• http://secunia.com/advisories/28094 · Note
• http://security.gentoo.org/glsa/glsa-200712-11.xml · Note
• http://securityfocus.com/bid/26864 · Note
• http://osvdb.org/42636 · Note