Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0497 advisory.

    [1.31.0.1.el5_2.1]
    - Add oracle-enterprise-release.patch

    [1.31.el5_2.1]
    - Remove RPATH from shared libraries in sblim-cmpi-{dns,fsvol,network,       nfsv3,nfsv4,samba,syslog}       and create appropriate record in /etc/ld.so.conf.d (CVE-2008-1951)       Resolves: #446859

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that certain sblim libraries had an RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. This RPATH pointed to a sub-directory of a world-writable, temporary directory. A local user could create a file with the same name as a library required by sblim (such as libc.so) and place it in the directory defined in the RPATH. This file could then execute arbitrary code with the privileges of the user running an application that used sblim (eg tog-pegasus). (CVE-2008-1951)

Updated sblim packages that resolve a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SBLIM stands for Standards-Based Linux Instrumentation for Manageability. It consists of a set of standards-based, Web-Based Enterprise Management (WBEM) modules that use the Common Information Model (CIM) standard to gather and provide systems management information, events, and methods to local or networked consumers via a CIM object services broker using the CMPI (Common Manageability Programming Interface) standard. This package provides a set of core providers and development tools for systems management applications.

It was discovered that certain sblim libraries had an RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. This RPATH pointed to a sub-directory of a world-writable, temporary directory. A local user could create a file with the same name as a library required by sblim (such as libc.so) and place it in the directory defined in the RPATH. This file could then execute arbitrary code with the privileges of the user running an application that used sblim (eg tog-pegasus). (CVE-2008-1951)

Users are advised to upgrade to these updated sblim packages, which resolve this issue.

ID	Name	Product	Family	Severity
67698	Oracle Linux 5 : sblim (ELSA-2008-0497)	Nessus	Oracle Linux Local Security Checks	critical
60428	Scientific Linux Security Update : sblim on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
33258	CentOS 4 : sblim (CESA-2008:0497)	Nessus	CentOS Local Security Checks	medium
33248	RHEL 4 / 5 : sblim (RHSA-2008:0497)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2008-1951

critical

Tenable Plugins

critical

medium

medium

medium