CVE-2007-6249

Executive Summary

Informations
Name	CVE-2007-6249	First vendor Publication	2007-12-14
Vendor	Cve	Last vendor Modification	2008-11-15

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score	2.1	Attack Range	Local
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	3.9	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6249

CWE : Common Weakness Enumeration

id	Name
CWE-200	Information Exposure

CPE : Common Platform Enumeration

Type	Description	Count
Application	Gentoo Portage cpe:/a:gentoo:portage:2.1.3.10	1

Open Source Vulnerability Database (OSVDB)

id	Description
42636	Gentoo Linux etc-update Permission Weakness Local Information Disclosure

Internal Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/26864
CONFIRM	http://bugs.gentoo.org/show_bug.cgi?id=193589 http://sources.gentoo.org/viewcvs.py/portage?rev=7799&view=rev
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200712-11.xml
OSVDB	http://osvdb.org/42636
SECTRACK	http://www.securitytracker.com/id?1019097
SECUNIA	http://secunia.com/advisories/28094
XF	http://xforce.iss.net/xforce/xfdb/39035