PT-2020-10411 · Gentoo+1 · Gentoo Portage+1

Michael Orlitzky · Published 2020-01-20 · Updated 2021-07-21 · CVE-2019-20384

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gentoo Portage versions 2.3.84 and earlier

Description The issue allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account. This is possible because the directory is writable between a call to emake and a call to fowners.

Recommendations For Gentoo Portage versions 2.3.84 and earlier, consider restricting write access to the /usr/lib64/nagios/plugins directory to prevent unauthorized placement of plugins. As a temporary workaround, monitor the directory for any suspicious activity and restrict access to the nagios user account until a fix is available.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2019-20384

Affected Products

Gentoo Portage

Nagios

References · 5

• 🔥 https://bugs.gentoo.org/692492 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2020/01/21/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20384 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20384 · Vendor Advisory
• https://t.me/cvenotify/344 · Telegram Post