CVE-2004-2778

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands.

CVSS v3 7.1 HIGH
CVSS v2.0 3.6 LOW

7.1^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 3.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2017/01/28/7	Mailing List Third Party Advisory
https://bugs.gentoo.org/show_bug.cgi?id=141619	Vendor Advisory
https://bugs.gentoo.org/show_bug.cgi?id=396153	Vendor Advisory
https://bugs.gentoo.org/show_bug.cgi?id=58611	Vendor Advisory
https://bugs.gentoo.org/show_bug.cgi?id=607426	Vendor Advisory
https://bugs.gentoo.org/show_bug.cgi?id=607430	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gentoo:portage:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-27 20:29

Updated : 2017-07-05 18:40

NVD link : CVE-2004-2778

Mitre link : CVE-2004-2778

CVE.ORG link : CVE-2004-2778

JSON object : View

Products Affected

gentoo

portage

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2004-2778", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2017-06-27T20:29:00.183", "references": [{"url": "http://www.openwall.com/lists/oss-security/2017/01/28/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=141619", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=396153", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=58611", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=607426", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.gentoo.org/show_bug.cgi?id=607430", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands."}, {"lang": "es", "value": "Ebuild en Gentoo puede cambiar los permisos de directorios y archivos en funci\u00f3n del orden de los paquetes instalados, lo que permite a usuarios locales leer o escribir en directorios restringidos o ejecutar comandos restringidos mediante la navegaci\u00f3n a directorios afectados o la ejecuci\u00f3n de comandos afectados."}], "lastModified": "2017-07-05T18:40:04.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gentoo:portage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D2DB2B2-6B07-44EC-A1BE-6E5B8A502D87"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}