PT-2008-1127 · Conserver+1 · Conserver+1

Robin Johnson · Published 2008-03-18 · Updated 2017-08-08 · CVE-2008-1383

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gentoo Linux (affected versions not specified) conserver versions prior to 8.1.16

Description The issue affects Gentoo Linux and is related to the handling of SSL keys and certificates. Specifically, the docert function in ssl-cert.eclass stores the SSL key in a binpkg when used by src compile or src install, allowing local users to extract the key. This results in multiple systems using the same SSL key and certificate if they use this binpkg. Additionally, there is a vulnerability in the conserver package that can lead to a breach of protected information, and it can be exploited locally.

Recommendations For conserver versions prior to 8.1.16, update to version 8.1.16 or later. At the moment, there is no information about a newer version of Gentoo Linux that contains a fix for this vulnerability.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-09633

CVE-2008-1383

Affected Products

Gentoo Linux

Conserver

References · 8

• http://security.gentoo.org/glsa/glsa-200803-30.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09633 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1383 · Security Note
• http://secunia.com/advisories/29436 · Vendor Advisory
• http://securityfocus.com/bid/28350 · Note
• http://osvdb.org/43479 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41336 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=174759 · Note