Bug 24329 - CVE-2010-3369: insecure library loading
Summary: CVE-2010-3369: insecure library loading
Status: NEW
Alias: None
Product: Sisyphus
Classification: Development
Component: mono-debugger (show other bugs)
Version: unstable
Hardware: all Linux
: P3 blocker
Assignee: Alexey Shabalin
QA Contact: qa-sisyphus
URL: http://bugs.debian.org/598299
Keywords: security
Depends on:
Blocks:
 
Reported: 2010-10-16 12:06 MSD by Vladimir Lettiev
Modified: 2015-02-14 11:38 MSK (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Lettiev 2010-10-16 12:06:40 MSD
The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.

Vulnerable code follows:

/usr/bin/mdb-symbolreader line 2:
export LD_LIBRARY_PATH="/usr/lib:${LD_LIBRARY_PATH}"
/usr/bin/mdb line 2:
export LD_LIBRARY_PATH="/usr/lib:${LD_LIBRARY_PATH}"

When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
Comment 1 Michael Shigorin 2015-02-14 11:38:06 MSK
В дебиане пишут, что исправлено в 2.6.3-2.1; у нас сейчас 2.10; upstream fix?