Description
The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Directory Server 8 | redhat-ds-admin | 8.2.1-1.el5dsrv | RHSA-2011:0293 |
| Red Hat Directory Server 8 | redhat-ds-base +1 | 8.2.4-1.el5dsrv | RHSA-2011:0293 |
Advisories 1
- RHSA-2011:0293 Red Hat Security Advisory: Red Hat Directory Server security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 1025102 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=672468
- RHSA-2011:0293 vendor-advisory
- rhds-ldlibrarypath-priv-esc(65637) vdb-entry
- 46489 vdb-entry