Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2020/01/21/1 | Exploit Mailing List Third Party Advisory |
| https://bugs.gentoo.org/692492 | Exploit Issue Tracking Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2020/01/21/1 | Exploit Mailing List Third Party Advisory |
| https://bugs.gentoo.org/692492 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
21 Nov 2024, 04:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2020/01/21/1 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://bugs.gentoo.org/692492 - Exploit, Issue Tracking, Vendor Advisory |
Information
Published : 2020-01-21 00:15
Updated : 2024-11-21 04:38
NVD link : CVE-2019-20384
Mitre link : CVE-2019-20384
CVE.ORG link : CVE-2019-20384
JSON object : View
Products Affected
gentoo
- portage
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')