Lucene search

Gentoo FoundationGLSA-200510-13

HistoryOct 15, 2005 - 12:00 a.m.

SPE: Insecure file permissions

2005-10-1500:00:00

Gentoo Foundation

security.gentoo.org

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Background

SPE is a cross-platform Python Integrated Development Environment (IDE).

Description

It was reported that due to an oversight all SPE’s files are set as world-writeable.

Impact

A local attacker could modify the executable files, causing arbitrary code to be executed with the permissions of the user running SPE.

Workaround

There is no known workaround at this time.

Resolution

All SPE users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose dev-util/spe

OSVersionArchitecturePackageVersionFilename
Gentooanyalldev-util/spe< 0.7.5c-r1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	dev-util/spe	< 0.7.5c-r1	UNKNOWN

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Related for GLSA-200510-13