blob: a63a7a26b72e42acda5cc332bd947bdbd9582d97 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200507-22">
<title>sandbox: Insecure temporary file handling</title>
The sandbox utility may create temporary files in an insecure manner.
<product type="ebuild">sandbox</product>
<announced>July 25, 2005</announced>
<revised>August 11, 2005: 02</revised>
<package name="sys-apps/sandbox" auto="yes" arch="*">
<unaffected range="ge">1.2.11</unaffected>
<vulnerable range="lt">1.2.11</vulnerable>
sandbox is a Gentoo Linux utility used by the Portage package
management system.
The Gentoo Linux Security Audit Team discovered that the sandbox
utility was vulnerable to multiple TOCTOU (Time of Check, Time of Use)
file creation race conditions.
<impact type="low">
Local users may be able to create or overwrite arbitrary files with the
permissions of the root user.
There is no known workaround at this time.
All sandbox users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=sys-apps/sandbox-1.2.11&quot;</code>
<uri link="">CAN-2005-2449</uri>
<metadata tag="requester" timestamp="Sat, 23 Jul 2005 11:46:49 +0000">
<metadata tag="submitter" timestamp="Sat, 23 Jul 2005 12:17:37 +0000">
<metadata tag="bugReady" timestamp="Sun, 24 Jul 2005 07:49:01 +0000">