| To: | security-announce@lists.rpath.com, update-announce@lists.rpath.com |
|---|---|
| Subject: | rPSA-2007-0020-1 rmake |
| From: | rPath Update Announcements <announce-noreply@rpath.com> |
| Date: | Thu, 25 Jan 2007 18:15:21 -0500 |
| Cc: | full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com, lwn@lwn.net |
| Delivered-to: | sp-com-lists@consult.net |
| Delivered-to: | bugtraq-list@securepoint.com |
| Delivered-to: | mailing list bugtraq@securityfocus.com |
| Delivered-to: | moderator for bugtraq@securityfocus.com |
| List-help: | <mailto:bugtraq-help@securityfocus.com> |
| List-id: | <bugtraq.list-id.securityfocus.com> |
| List-post: | <mailto:bugtraq@securityfocus.com> |
| List-subscribe: | <mailto:bugtraq-subscribe@securityfocus.com> |
| List-unsubscribe: | <mailto:bugtraq-unsubscribe@securityfocus.com> |
| Mailing-list: | contact bugtraq-help@securityfocus.com; run by ezmlm |
| User-agent: | nail 11.22 3/20/05 |
rPath Security Advisory: 2007-0020-1
Published: 2007-01-25
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
Local Root Deterministic Privilege Escalation
Updated Versions:
rmake=/conary.rpath.com@rpl:devel//1/1.0.3-2-0.1
References:
https://issues.rpath.com/browse/RPL-987
Description:
Previous versions of the rmake package do not drop supplemental users
in the changeroot environment for builds. This provides malicious
packages with excess permissions that are configuration-dependent,
and may allow local users to run arbitrary code as the root user.
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | rPSA-2007-0021-1 bind bind-utils, rPath Update Announcements |
|---|---|
| Next by Date: | Dexia website security alert, Jos Kirps |
| Previous by Thread: | rPSA-2007-0021-1 bind bind-utils, rPath Update Announcements |
| Next by Thread: | Dexia website security alert, Jos Kirps |
| Indexes: | [Date] [Thread] [Top] [All Lists] |