Description
bareFTP 0.3.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
References
- ADV-2010-3141 vdb-entry
- FEDORA-2010-18323 vendor-advisory
- bareftp-ldlibpath-priv-escalation(64433) vdb-entry
- 42521 third-party-advisory
- FEDORA-2010-18310 vendor-advisory
- http://gitorious.org/bareftp/bareftp/blobs/15489abdb4c698cf832e95184bfe769a1ba70238/ChangeLog
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598284
- 44334 vdb-entry