PT-2017-4428 · Gentoo · Gentoo

Published 2017-06-27 · Updated 2017-07-05 · CVE-2004-2778

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Gentoo (affected versions not specified)

Description: The issue in Gentoo allows local users to access restricted directories or execute commands they should not be able to, due to how the Ebuild handles directory and file permissions based on the order of package installation. This could enable users to read or write to restricted areas or execute commands that are normally restricted.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2004-2778

Affected Products

Gentoo

References · 7

• https://bugs.gentoo.org/show_bug.cgi?id=141619 · Vendor Advisory
• https://bugs.gentoo.org/show_bug.cgi?id=607430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2778 · Security Note
• https://bugs.gentoo.org/show_bug.cgi?id=607426 · Vendor Advisory
• https://bugs.gentoo.org/show_bug.cgi?id=58611 · Vendor Advisory
• https://bugs.gentoo.org/show_bug.cgi?id=396153 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/01/28/7 · Note