Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary     programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a     malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including     this issue because execution of a program from an untrusted directory is a common scenario.
    (CVE-2008-4865)

Note that Nessus relies on the presence of the package as reported by the vendor.

valgrind reads a file .valgrindrc in the current directory. Therefore local users could place such a file a world-writable directory such as /tmp and influence other users' valgrind when it's executed there.
(CVE-2008-4865)

valgrind reads a file .valgrindrc in the current directory. Therefore local users could place such a file a world-writable directory such as /tmp and influence other users' valgrind when it's executed there (CVE-2008-4865).

A vulnerability has been identified and corrected in valgrind :

Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario. (CVE-2008-4865)

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200902-03 (Valgrind: Untrusted search path)

    Tavis Ormandy reported that Valgrind loads a .valgrindrc file in the     current working directory, executing commands specified there.
  Impact :

    A local attacker could prepare a specially crafted .valgrindrc file and     entice a user to run Valgrind from the directory containing that file,     resulting in the execution of arbitrary code with the privileges of the     user running Valgrind.
  Workaround :

    Do not run 'valgrind' from untrusted working directories.

ID	Name	Product	Family	Type	Severity
217069	Linux Distros Unpatched Vulnerability : CVE-2008-4865	Nessus	Misc.	Local	critical
51763	SuSE 10 Security Update : valgrind (ZYPP Patch Number 5803)	Nessus	SuSE Local Security Checks	Local	high
40146	openSUSE Security Update : valgrind (valgrind-321)	Nessus	SuSE Local Security Checks	Local	high
38051	Mandriva Linux Security Advisory : valgrind (MDVSA-2009:057)	Nessus	Mandriva Local Security Checks	Local	high
35674	GLSA-200902-03 : Valgrind: Untrusted search path	Nessus	Gentoo Local Security Checks	Local	high
34989	openSUSE 10 Security Update : valgrind (valgrind-5809)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2008-4865

high

Tenable Plugins

critical

high

high

high

high

high