PT-2007-6285 · Rmake · Rmake

Published 2007-10-04 · Updated 2018-10-15 · CVE-2007-5194

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rMake version 1.0.11

Description The issue concerns the Chroot server in rMake, which creates a /dev/zero device file with read/write permissions for the rMake user and the same minor device number as /dev/port. This might allow local users to gain root privileges.

Recommendations For rMake version 1.0.11, consider restricting access to the /dev/zero device file to prevent local users from exploiting this issue. As a temporary workaround, review and adjust the permissions of the /dev/zero device file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5194

Affected Products

Rmake

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5194 · Security Note
• https://issues.rpath.com/browse/RMK-634 · Note
• http://securityfocus.com/archive/1/481395/100/0/threaded · Note
• http://securityfocus.com/bid/25899 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=194550 · Note
• http://secunia.com/advisories/27030 · Note