Description
sfcb in sblim-sfcb places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sblim-sfcb | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | sblim-sfcb | No fix yet | — |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=838160
- [oss-security] 20120706 Re: CVE Request: sblim-sfcb: insecure LD_LIBRARY_PATH usage mailing-list
- http://sourceforge.net/tracker/index.php?func=detail&aid=3541554&group_id=128809&atid=712784
- https://bugzilla.novell.com/show_bug.cgi?id=770234
- [oss-security] 20120706 CVE Request: sblim-sfcb: insecure LD_LIBRARY_PATH usage mailing-list