Improper file ownership allows user-owned files to be run with root privileges by init scripts.
Package | sci-misc/gimps on all architectures |
---|---|
Affected versions | <= 23.9 |
Unaffected versions | >= 23.9-r1 |
Package | sci-misc/setiathome on all architectures |
---|---|
Affected versions | <= 3.08-r3 |
Unaffected versions | >= 3.08-r4 revision >= 3.03-r2 |
Package | sci-misc/chessbrain on all architectures |
---|---|
Affected versions | <= 20407 |
Unaffected versions | >= 20407-r1 |
GIMPS is a client for the distributed Great Internet Mersenne Prime Search. SETI@home is the client for the Search for Extraterrestrial Intelligence (SETI) project. ChessBrain is the client for the distributed chess supercomputer.
GIMPS, SETI@home and ChessBrain ebuilds install user-owned binaries and init scripts which are executed with root privileges.
This could lead to a local privilege escalation or root compromise.
There is no known workaround at this time.
All GIMPS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sci-misc/gimps-23.9-r1"
All SETI@home users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sci-misc/setiathome-3.03-r2"
All ChessBrain users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sci-misc/chessbrain-20407-r1"
Release date
November 17, 2004
Latest revision
May 22, 2006: 03
Severity
high
Exploitable
local
Bugzilla entries