CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
0.4%
webapp-config is a Gentoo Linux utility to help manage the installation of web-based applications.
Eric Romang discovered webapp-config uses a predictable temporary filename while processing certain options, resulting in a race condition.
Successful exploitation of the race condition would allow an attacker to disrupt the operation of webapp-config, or execute arbitrary shell commands with the privileges of the user running webapp-config. A local attacker could use a symlink attack to create or overwrite files with the permissions of the user running webapp-config.
There is no known workaround at this time.
All webapp-config users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/webapp-config-1.11"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | app-admin/webapp-config | < 1.11 | UNKNOWN |