dev-scheme/gauche-0.9.15-r1 — Security Advisories

portage-ng glsa

▸ GLSA 200512-07 OpenLDAP, Gauche: RUNPATH issues this version unaffected low local 2005-12-15

OpenLDAP and Gauche suffer from RUNPATH issues that may allow users in the "portage" group to escalate privileges.

Announced: 2005-12-15
Revised: 2007-12-30 (revision 3)
Access: local
Bugs: #105380 #112577
Advisory: https://security.gentoo.org/glsa/200512-07

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-scheme/gauche	*	< 0.8.6-r1	>= 0.8.6-r1
net-nds/openldap	*	< 2.2.28-r3	>= 2.2.28-r3, >= 2.1.30-r6 (revision)

Background

OpenLDAP is a suite of LDAP-related application and development tools. Gauche is an R5RS Scheme interpreter.

Description

Gentoo packaging for OpenLDAP and Gauche may introduce insecure paths into the list of directories that are searched for libraries at runtime.

Impact

A local attacker, who is a member of the "portage" group, could create a malicious shared object in the Portage temporary build directory that would be loaded at runtime by a dependent binary, potentially resulting in privilege escalation.

Workaround

Only grant "portage" group rights to trusted users.

Resolution

All OpenLDAP users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose net-nds/openldap

All Gauche users should upgrade to the latest version: