Gentoo: gnupg Unauthorized acess
gpg needs to be setuid to make use of protected memory space, however thesetgid bit allowed gpg user to overwrite goup root writable files and istherefore unnecessary.
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200307-06 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
gpg needs to be setuid to make use of protected memory space, however the setgid bit allowed gpg user to overwrite goup root writable files and is therefor unnecessary.
SOLUTION
It is recommended that all Gentoo Linux users who are running app-crypt/gnupg upgrade to gnupg-1.2.2-r1 as follows
emerge sync emerge gnupg emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at taviso@gentoo.org - - ---------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : gnupg
SUMMARY : gpg setgid
DATE : 2003-07-19 14:27 UTC
EXPLOIT : local
VERSIONS AFFECTED : =gnupg-1.2.2-r1
CVE :
Background
