Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 498
Alerts This Week
Warning Icon 1 498

Gentoo: GLSA-201709-11 High: GIMPS Privilege Escalation Threat

gentoo
Calendar Grey September 17, 2017
Dist Gentoo Esm H88
Gentoo GLSA 202310-07 highlights a critical vulnerability in the GIMPS system, permitting unauthorized local privilege elevation. Recommended to upgrade.
Gentoo's GIMPS ebuilds are vulnerable to privilege escalation due to improper permissions

Summary

It was discovered that Gentoo’s default GIMPS installation suffered from a privilege escalation vulnerability in the init script. This script calls an unsafe "chown -R" command in checkconfig() function.

Topics%20covered

Topics Covered

security advisory high severity security issue gentoo privilege escalation local attack gimps

Resolution

All GIMPS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sci-mathematics/gimps-28.10-r1"

References

[ 1 ] CVE-2017-14484 https://nvd.nist.gov/vuln/detail/CVE-2017-14484

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-11
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: GIMPS: Root privilege escalation
Date: September 17, 2017
Bugs: #603408
ID: 201709-11

Topics%20covered

Topics Covered

security advisory high severity security issue gentoo privilege escalation local attack gimps

Synopsis

Gentoo's GIMPS ebuilds are vulnerable to privilege escalation due to improper permissions. A local attacker could use it to gain root privileges.

Background

GIMPS, the Great Internet Mersenne Prime Search, is a software capable of find Mersenne Primes, which are used in cryptography. GIMPS is also used for hardware testing.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sci-mathematics/gimps < 28.10-r1 >= 28.10-r1

Impact

===== A local attacker who does not belong to the root group, but has the ability to modify the /var/lib/gimps directory can escalate privileges to the root group.

Workaround

There is no known workaround at this time.