festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

festival_server uses an unsafe LD_LIBRARY_PATH. Local users could exploit that to execute code as another user if that user runs festival_server. CVE-2010-3996 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201312-06 (Festival: Arbitrary code execution)

    A vulnerability in Festival Server has an incorrect path in       LD_LIBRARY_PATH, which allows local users to place a Trojan horse shared       library in the current working directory.
  Impact :

    A local attacker can execute arbitrary a Trojan horse shared library,       potentially resulting in arbitrary code execution and privilege       escalation.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
75487	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	medium
71258	GLSA-201312-06 : Festival: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
50317	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	medium
50316	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-3996

high

Tenable Plugins

medium

medium

medium

medium