oss-security February 2011 archive
Main Archive Page > Month Archives  > oss-security archives
oss-security: [oss-security] CVE request: glibc CVE-2010-3847 fi

[oss-security] CVE request: glibc CVE-2010-3847 fix regression

From: Tomas Hoger <thoger_at_nospam>
Date: Tue Feb 01 2011 - 14:27:23 GMT
To: OSS Security <oss-security@lists.openwall.com>

Hi!

It seems this does not have any CVE assigned yet...

The original patch for CVE-2010-3847, as used by multiple vendors,
introduced a bug in the way $ORIGIN is (not-)expanded when used in ELF
R*PATH. This could allow a local user to escalate privileges via
privileged program using a library with $ORIGIN in R*PATH (such as
certain glibc iconv modules).

There are at least Debian and Ubuntu advisories addressing this issue:
http://lists.debian.org/debian-security-announce/2011/msg00005.html
https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-January/001226.html

Note that privileged programs that themselves have $ORIGIN in R*PATH
could have been abused before and are not addressed in the above
advisories. It's unclear if any distro provides any privileged program
with such R*PATH though.

-- Tomas Hoger / Red Hat Security Response Team