The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Berkeley DB NSS module
  - cURL / libcURL
  - GnuTLS
  - Network Security Services (NSS) Library
  - OpenLDAP
  - OpenSSL
  - OpenSSL Kerberos
  - sudo

From Red Hat Security Advisory 2010:0347 :

Updated nss_db packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The nss_db packages provide a set of C library extensions which allow Berkeley Database (Berkeley DB) databases to be used as a primary source of aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services, and shadow passwords. These databases are used instead of or in addition to the flat files used by these tools by default.

It was discovered that nss_db did not specify a path to the directory to be used as the database environment for the Berkeley Database library, causing it to use the current working directory as the default. This could possibly allow a local attacker to obtain sensitive information. (CVE-2010-0826)

Users of nss_db are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

It was discovered that nss_db did not specify a path to the directory to be used as the database environment for the Berkeley Database library, causing it to use the current working directory as the default. This could possibly allow a local attacker to obtain sensitive information. (CVE-2010-0826)

a. Service Console update for NSS_db

   The service console package NSS_db is updated to version    nss_db-2.2-35.4.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0826 to this issue.

b. Service Console update for OpenLDAP

   The service console package OpenLDAP updated to version    2.3.43-12.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-3767 to this issue.

c. Service Console update for cURL

   The service console packages for cURL updated to version    7.15.5-9.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to this issue.

d. Service Console update for sudo

   The service console package sudo updated to version 1.7.2p1-7.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1646 to this issue.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

   Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2    and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,    and NSS to version 3.12.6-1.3235.vmw and NSPR to version    4.8.4-1.3235.vmw. These four updates are bundled together due to    their mutual dependencies.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245    and CVE-2010-0433 to the issues addressed in this update.

A vulnerability has been found and corrected in nss_db :

The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module (CVE-2010-0826).

The updated packages have been patched to correct this issue.

Stephane Chazelas reported that the nss_db module attempts to read a DB_CONFIG file in the current directory when it is used. If the contents of the file can't be parsed properly, the copy of libdb which nss_db uses will print an error message. If nss_db is invoked from a setuid process, it may then expose privileged information to the unprivileged user who started the process. This update imports Kees Cook's fix for the issue (CVE-2010-0826).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated nss_db packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The nss_db packages provide a set of C library extensions which allow Berkeley Database (Berkeley DB) databases to be used as a primary source of aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services, and shadow passwords. These databases are used instead of or in addition to the flat files used by these tools by default.

It was discovered that nss_db did not specify a path to the directory to be used as the database environment for the Berkeley Database library, causing it to use the current working directory as the default. This could possibly allow a local attacker to obtain sensitive information. (CVE-2010-0826)

Users of nss_db are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Stephane Chazelas discovered that libnss-db did not correctly set up a database environment. A local attacker could exploit this to read the first line of arbitrary files, leading to a loss of privacy and possibly privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89742	VMware ESX Multiple Vulnerabilities (VMSA-2010-0015) (remote check)	Nessus	VMware ESX Local Security Checks	critical
68030	Oracle Linux 5 : nss_db (ELSA-2010-0347)	Nessus	Oracle Linux Local Security Checks	low
60780	Scientific Linux Security Update : nss_db on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
49703	VMSA-2010-0015 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	critical
48179	Mandriva Linux Security Advisory : nss_db (MDVSA-2010:077)	Nessus	Mandriva Local Security Checks	low
47434	Fedora 12 : nss_db-2.2-47.fc12 (2010-6361)	Nessus	Fedora Local Security Checks	low
47431	Fedora 11 : nss_db-2.2-46.fc11 (2010-6331)	Nessus	Fedora Local Security Checks	low
47423	Fedora 13 : nss_db-2.2.3-0.3.pre1.fc13 (2010-6203)	Nessus	Fedora Local Security Checks	low
46755	CentOS 5 : nss_db (CESA-2010:0347)	Nessus	CentOS Local Security Checks	low
46297	RHEL 5 : nss_db (RHSA-2010:0347)	Nessus	Red Hat Local Security Checks	low
45398	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : libnss-db vulnerability (USN-922-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2010-0826

critical

Tenable Plugins

critical

low

low

critical

low

low

low

low

low

low

low