Gentoo: 200411-13 Normal: Symlink Overwrite Threat in Portage & Gentoolkit

Gentoo Linux Security Advisory GLSA 200411-13:01 https://security.gentoo.org/ Severity: Normal Title: Portage, Gentoolkit: Temporary file vulnerabilities Date: November 07, 2004 Bugs: #68846, #69147 ID: 200411-13:01

Synopsis ======= dispatch-conf (included in Portage) and qpkg (included in Gentoolkit) are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the script.
Background ========= Portage is Gentoo's package management tool. The dispatch-conf utility allows for easy rollback of configuration file changes and automatic updates of configurations files never modified by users. Gentoolkit is a collection of Gentoo specific administration scripts, one of which is the portage querying tool qpkg.
Affected packages ================ ------------------------------------------------------------------- Packag...