PT-2008-1104 · Gentoo · Portage

Published 2008-10-09 · Updated 2017-08-08 · CVE-2008-4394

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Portage versions prior to 2.1.4.5

Description The issue concerns untrusted search path vulnerabilities in Portage, allowing local users to execute arbitrary code via modified Python modules loaded by various ebuilds, including ys-apps/portage, net-mail/fetchmail, and app-editors/leo. This vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information. It can be exploited locally.

Recommendations For versions prior to 2.1.4.5, update to version 2.1.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable ebuilds until a patch is applied. Avoid using the affected ebuilds in sensitive environments until the issue is resolved.

Fix

Related Identifiers

BDU:2015-09360

CVE-2008-4394

Affected Products

Portage

References · 6

• http://security.gentoo.org/glsa/glsa-200810-02.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09360 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-4394 · Security Note
• http://secunia.com/advisories/32228 · Vendor Advisory
• http://securityfocus.com/bid/31670 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45792 · Note