Secunia

Gentoo has acknowledged a security issue in multiple ebuilds, which can lead to the disclosure of sensitive information.

The security issue is caused due to the ebuilds calling the "docert()" function of the ssl-cert eclass from within the source building state. This leads to sensitive SSL certificates being included in the generated package, which potentially can be exploited by attackers to extract the keys and leverage them for further attacks.

Successful exploitation requires access to a binary package built with the "--buildpkg" or "--buildpkgonly" options.

The following ebuilds are affected:
* app-admin/conserver prior to 8.1.16
* mail-mta/postfix prior to 2.4.6-r2
* net-ftp/netkit-ftpd prior to 0.17-r7
* net-im/ejabberd prior to 1.1.3
* net-irc/unrealircd prior to 3.2.7-r2
* net-mail/cyrus-imapd prior to 2.3.9-r1
* net-mail/dovecot prior to 1.0.10
* net-misc/stunnel 4.x prior to 4.21-r
* net-nntp/inn prior to 2.4.3-r1

Solution
Remove SSL certificates generated by portage and generate new packages using updated ebuilds. Please see the vendor's advisory for more information.

Provided and/or discovered by
Robin Johnson

Original Advisory
http://www.gentoo.org/security/en/glsa/glsa-200803-30.xml

Deep Links
Links available in Customer Area