Description
Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | sblim +6 | 1-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cim-client | 1.3.3-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-base +2 | 1.5.5-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-devel | 1.0.4-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-dns +1 | 0.5.2-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-fsvol +2 | 1.4.4-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-network +2 | 1.3.8-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-nfsv3 +1 | 1.0.14-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-nfsv4 +1 | 1.0.12-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-params +1 | 1.2.6-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-sysfs +1 | 1.1.9-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-cmpi-syslog +1 | 0.7.11-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-gather +3 | 2.1.2-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-testsuite | 1.2.4-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-tools-libra +1 | 0.2.3-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 5 | sblim-wbemcli | 1.5.1-31.el5_2.1 | RHSA-2008:0497 |
| RHEL 4 | sblim | 1-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-base +2 | 1.5.4-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-devel | 1.0.4-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-fsvol +2 | 1.4.3-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-network +2 | 1.3.7-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-nfsv3 +1 | 1.0.13-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-nfsv4 +1 | 1.0.11-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-sysfs +1 | 1.1.8-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-cmpi-syslog +1 | 0.7.9-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-gather +3 | 2.1.1-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-testsuite +2 | 1.2.4-13a.el4_6.1 | RHSA-2008:0497 |
| RHEL 4 | sblim-wbemcli | 1.5.1-13a.el4_6.1 | RHSA-2008:0497 |
Advisories 1
- RHSA-2008:0497 Red Hat Security Advisory: sblim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 30803 third-party-advisory
- oval:org.mitre.oval:def:9635 vdb-entry signature
- redhat-sblim-privilege-escalation(43315) vdb-entry
- RHSA-2008:0497 vendor-advisory
- 1020354 vdb-entry
- 29913 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=447705