Multiple untrusted search path vulnerabilities in SUSE Linux 9.3 and 10.0, and possibly other distributions, cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) beagle, (2) tomboy, or (3) blam. NOTE: in August 2007, the tomboy vector was reported for other distributions.

A flaw in how tomboy handles LD_LIBRARY_PATH was discovered where by appending paths to LD_LIBRARY_PATH the program would also search the current directory for shared libraries. In directories containing network data, those libraries could be injected into the application.

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200801-14 (Blam: User-assisted execution of arbitrary code)

    The '/usr/bin/blam' script sets the 'LD_LIBRARY_PATH' environment     variable incorrectly, which might result in the current working     directory (.) being included when searching for dynamically linked     libraries of the Mono Runtime application.
  Impact :

    A local attacker could entice a user to run Blam in a directory     containing a specially crafted library file which could result in the     execution of arbitrary code with the privileges of the user running     Blam.
  Workaround :

    Do not run Blam from an untrusted working directory.

Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update resolves a low severity security issue where LD_LIBRARY_PATH could potentially get set to the current directory if it wasn't set before Blam was launched.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The tomboy mediaplayer used LD_LIBRARY_PATH unsafely by allowing empty LD_LIBRARY_PATH components.

This would enable the player to load its shared libraries of the current directory which might contain user-supplied shared libraries, potentially supplied from the network by an attacker. (CVE-2005-4790)

This update resolves a low severity security issue where LD_LIBRARY_PATH could potentially get set to the current directory if it wasn't set before Tomboy was launched.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-12 (Tomboy: User-assisted execution of arbitrary code)

    Jan Oravec reported that the '/usr/bin/tomboy' script sets the     'LD_LIBRARY_PATH' environment variable incorrectly, which might result     in the current working directory (.) to be included when searching for     dynamically linked libraries of the Mono Runtime application.
  Impact :

    A local attacker could entice a user into running Tomboy in a directory     containing a specially crafted library file to execute arbitrary code     with the privileges of the user running Tomboy.
  Workaround :

    Do not run Tomboy from an untrusted working directory.

ID	Name	Product	Family	Severity
37621	Mandriva Linux Security Advisory : tomboy (MDVSA-2008:064)	Nessus	Mandriva Local Security Checks	medium
30119	GLSA-200801-14 : Blam: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
29892	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : tomboy vulnerability (USN-560-1)	Nessus	Ubuntu Local Security Checks	medium
28343	Fedora 8 : blam-1.8.3-11.fc8 (2007-3798)	Nessus	Fedora Local Security Checks	medium
28342	Fedora 7 : blam-1.8.3-9.fc7 (2007-3792)	Nessus	Fedora Local Security Checks	medium
28287	openSUSE 10 Security Update : tomboy (tomboy-4698)	Nessus	SuSE Local Security Checks	medium
28190	Fedora 8 : tomboy-0.8.1-3.fc8 (2007-3253)	Nessus	Fedora Local Security Checks	medium
28156	Fedora 7 : tomboy-0.6.1-2.fc7 (2007-3011)	Nessus	Fedora Local Security Checks	medium
27847	GLSA-200711-12 : Tomboy: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-4790

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium