Gentoo Archives: gentoo-announce

From: Thierry Carrez <koon@g.o>
To: gentoo-announce@l.g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××××.uk, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 200510-13 ] SPE: Insecure file permissions
Date: Sat, 15 Oct 2005 10:15:26
Message-Id: 4350D289.7090409@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 200510-13
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: SPE: Insecure file permissions
9 Date: October 15, 2005
10 Bugs: #108538
11 ID: 200510-13
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 SPE files are installed with world-writeable permissions, potentially
19 leading to privilege escalation.
20
21 Background
22 ==========
23
24 SPE is a cross-platform Python Integrated Development Environment
25 (IDE).
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 dev-util/spe < 0.7.5c-r1 >= 0.7.5c-r1
34 *>= 0.5.1f-r1
35
36 Description
37 ===========
38
39 It was reported that due to an oversight all SPE's files are set as
40 world-writeable.
41
42 Impact
43 ======
44
45 A local attacker could modify the executable files, causing arbitrary
46 code to be executed with the permissions of the user running SPE.
47
48 Workaround
49 ==========
50
51 There is no known workaround at this time.
52
53 Resolution
54 ==========
55
56 All SPE users should upgrade to the latest version:
57
58 # emerge --sync
59 # emerge --ask --oneshot --verbose dev-util/spe
60
61 Availability
62 ============
63
64 This GLSA and any updates to it are available for viewing at
65 the Gentoo Security Website:
66
67 http://security.gentoo.org/glsa/glsa-200510-13.xml
68
69 Concerns?
70 =========
71
72 Security is a primary focus of Gentoo Linux and ensuring the
73 confidentiality and security of our users machines is of utmost
74 importance to us. Any security concerns should be addressed to
75 security@g.o or alternatively, you may file a bug at
76 http://bugs.gentoo.org.
77
78 License
79 =======
80
81 Copyright 2005 Gentoo Foundation, Inc; referenced text
82 belongs to its owner(s).
83
84 The contents of this document are licensed under the
85 Creative Commons - Attribution / Share Alike license.
86
87 http://creativecommons.org/licenses/by-sa/2.0

Attachments

File name MIME type
signature.asc application/pgp-signature