PT-2007-1996 · Rpath · Rpath Linux+1

Published 2007-01-27 · Updated 2017-07-29 · CVE-2007-0536

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rPath Linux 1

Description The issue is related to the chroot helper in rMake, which does not drop supplemental groups. This causes packages to be installed with insecure permissions and might allow local users to gain privileges.

Recommendations For rPath Linux 1, consider updating the rMake package to a version that correctly drops supplemental groups, or apply a configuration change to ensure that packages are installed with secure permissions. As a temporary workaround, restrict the use of the chroot helper in rMake to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0536

Affected Products

Rmake

Rpath Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-0536 · Security Note
• http://secunia.com/advisories/23922 · Note
• https://issues.rpath.com/browse/RPL-987 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31942 · Note
• http://lists.rpath.com/pipermail/security-announce/2007-January/000137.html · Note
• http://osvdb.org/32972 · Note