CVE-2004-1901 Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
MediumCVSS 5.5
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gentoo portage | < 2.0.50 | 2.0.50 |
| gentoo portage | = 2.0.50 | No fix listed |
| gentoo linux | = 1.4 | No fix listed |
| gentoo linux | = 1.4-rc1 | No fix listed |
| gentoo linux | = 1.4-rc2 | No fix listed |
References
- 11305 broken-link patch third-party-advisory
- GLSA-200404-01 vendor-advisory
- 10060 broken-link patch third-party-advisory vdb-entry
- portage-lockfile-hardlink(15754) third-party-advisory vdb-entry