[ GLSA 201412-44 ] policycoreutils

[GLSA]

Gentoo Linux Security Advisory

Title: policycoreutils: Privilege escalation (GLSA 201412-44)
Severity: high
Exploitable: local
Date: December 26, 2014
Bug(s): #509896
ID: 201412-44

Synopsis

A vulnerability in policycoreutils could lead to local privilege
escalation.


Background

policycoreutils is a collection of SELinux policy utilities.

Affected Packages

Package: sys-apps/policycoreutils
Vulnerable: < 2.2.5-r4
Unaffected: >= 2.2.5-r4
Architectures: All supported architectures


Description

The seunshare utility is owned by root with 4755 permissions which can
be exploited by a setuid system call.


Impact

A local attacker may be able to gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All policycoreutils users should upgrade to the latest version: