Stay Secure with the Latest Linux Advisories

security advisoryhigh severitysecurity issue

Gentoo: GLSA-201709-11 High: GIMPS Privilege Escalation Threat

Gentoo's GIMPS ebuilds are vulnerable to privilege escalation due to improper permissions. A local attacker could use it to gain root privileges. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201709-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: GIMPS: Root privilege escalation Date: September 17, 2017 Bugs: #603408 ID: 201709-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Gentoo's GIMPS ebuilds are vulnerable to privilege escalation due to improper permissions. A local attacker could use it to gain root privileges. Background ========= GIMPS, the Great Internet Mersenne Prime Search, is a software capable of find Mersenne Primes, which are used in cryptography. GIMPS is also used for hardware testing. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sci-mathematics/gimps < 28.10-r1 > = 28.10-r1 Description ========== It was discovered that Gentoo’s default GIMPS installation suffered from a privilege escalation vulnerability in the init script. This script calls an unsafe "chown -R" command in checkconfig() function. Impact ===== A local attacker who does not belong to the root group, but has the ability to modify the /var/lib/gimps directory can escalate privileges to the root group. Workaround ========= There is no known workaround at this time. Resolution ========= All GIMPS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sci-mathematics/gimps-28.10-r1" References ========= [ 1 ] CVE-2017-14484 https://nvd.nist.gov/vuln/detail/CVE-2017-14484 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-11 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Gentoo GLSA 202310-07 highlights a critical vulnerability in the GIMPS system, permitting unauthorized local privilege elevation. Recommended to upgrade.. Gentoo, GIMPS, Privilege Escalation, High Severity, Security Advisory. . LinuxSecurity.com Team

Sep 17, 2017 Gentoo