Multiple Untrusted Search Path Vulnerabilities in Portage by Gentoo
CVE-2008-4394

Currently unrated

Key Information:

Vendor: Gentoo
Status: Portage
Vendor: CVE Published:; 10 October 2008

What is CVE-2008-4394?

Multiple vulnerabilities in Portage prior to version 2.1.4.5 allow local users to exploit the inclusion of the current working directory in the Python search path. This can lead to the execution of arbitrary code via maliciously crafted Python modules that are loaded by certain ebuilds, including ys-apps/portage, net-mail/fetchmail, and app-editors/leo. It poses a significant risk if the local environment is compromised or improperly secured.

References

http://secunia.com/advisories/32228

third-party-advisoryx_refsource_SECUNIA

http://security.gentoo.org/glsa/glsa-200810-02.xml

vendor-advisoryx_refsource_GENTOO

http://www.securityfocus.com/bid/31670

vdb-entryx_refsource_BID

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 10, 2008
Vulnerability Reserved
Oct 2, 2008