CVE-2007-0476 The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp secure...
MediumCVSS 4.6
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gentoo linux | = 2.1.30-r9 | No fix listed |
| gentoo linux | = 2.2.28-r7 | No fix listed |
| gentoo linux | = 2.3.30-r2 | No fix listed |
References
- 31617 vdb-entry
- 23881 third-party-advisory vendor-advisory
- GLSA-200701-19 vendor-advisory
- 22195 vdb-entry
- ADV-2007-0305 vdb-entry