CVE-2019-20384: Race Condition
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-20384?
CVE-2019-20384 is a vulnerability in Gentoo Portage that allows local users to place a Trojan horse plugin in a specific directory.
What is the severity of CVE-2019-20384?
CVE-2019-20384 has a severity rating of medium.
What software is affected by CVE-2019-20384?
Gentoo Portage version 2.3.84 is affected by CVE-2019-20384.
How can an attacker exploit CVE-2019-20384?
An attacker can exploit CVE-2019-20384 by leveraging access to the nagios user account and placing a Trojan horse plugin in the /usr/lib64/nagios/plugins directory.
Are there any references for CVE-2019-20384?
Yes, you can find references for CVE-2019-20384 at the following links: [Link 1](http://www.openwall.com/lists/oss-security/2020/01/21/1) and [Link 2](https://bugs.gentoo.org/692492).