rPSA-2007-0020-1 rmake
- From: rPath Update Announcements <announce-noreply@xxxxxxxxx>
- Date: Thu, 25 Jan 2007 18:15:21 -0500
rPath Security Advisory: 2007-0020-1
Published: 2007-01-25
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
Local Root Deterministic Privilege Escalation
Updated Versions:
rmake=/conary.rpath.com@rpl:devel//1/1.0.3-2-0.1
References:
https://issues.rpath.com/browse/RPL-987
Description:
Previous versions of the rmake package do not drop supplemental users
in the changeroot environment for builds. This provides malicious
packages with excess permissions that are configuration-dependent,
and may allow local users to run arbitrary code as the root user.
- Prev by Date: rPSA-2007-0021-1 bind bind-utils
- Next by Date: Dexia website security alert
- Previous by thread: rPSA-2007-0021-1 bind bind-utils
- Next by thread: Dexia website security alert
- Index(es):
