リモートの Oracle Linux 5 ホストに、ELSA-2010-0039 のアドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

    [4.1.2-46.el5_4.2]
    - 現在の作業ディレクトリまたはそのサブディレクトリから *.la/dlopening *.so ファイルが開かれないように libjava を修正します#545672、 CVE-2009-3736

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - GNU Libtool 1.5.x、 2.2.6 の libltdl.c は、Ham Radio Control Libraries、Q、およびその他の製品で使用されている 2.2.6b より前のバージョンでは、現在の作業ディレクトリで .la ファイルを開こうとします。これにより、ローカルユーザーがトロイの木馬ファイルを介して権限を取得する可能性があります。 （CVE-2009-3736）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

This update makes Gnash use the system version of the libltdl library instead of the bundled copy which was vulnerable to CVE-2009-3736. An update to the system libltdl fixing CVE-2009-3736 was issued on December 21, 2009.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Not sure whether mingw32-libltdl (due to its special nature in being for cross- compilation development for an entirely different system) is actually affected by CVE-2009-3736, but this should make sure everything is fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update patches the bundled copy of libltdl library which was vulnerable to CVE-2009-3736.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rebuilt against system libltdl.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2009-3736 libtool: libltdl may load and execute code from a library in the current directory

A flaw was found in the way GNU Libtool's libltdl library looked for libraries to load. It was possible for libltdl to load a malicious library from the current working directory. In certain configurations, if a local attacker is able to trick a local user into running a Java application (which uses a function to load native libraries, such as System.loadLibrary) from within an attacker-controlled directory containing a malicious library or module, the attacker could possibly execute arbitrary code with the privileges of the user running the Java application. (CVE-2009-3736)

All running Java applications using libgcj must be restarted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0039 advisory.

    [4.1.2-46.el5_4.2]
    - fix libjava to avoid opening *.la/dlopening *.so files from current       working directory or subdirectories thereof (#545672, CVE-2009-3736)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries,     Q, and possibly other products, attempts to open a .la file in the current working directory, which allows     local users to gain privileges via a Trojan horse file. (CVE-2009-3736)

Note that Nessus relies on the presence of the package as reported by the vendor.

libtool: libltdl may load modules from the current working directory.
CVE-2009-3736 has been assigned to this issue.

Updated gcc and gcc4 packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gcc and gcc4 packages include, among others, C, C++, and Java GNU compilers and related support libraries. libgcj contains a copy of GNU Libtool's libltdl library.

A flaw was found in the way GNU Libtool's libltdl library looked for libraries to load. It was possible for libltdl to load a malicious library from the current working directory. In certain configurations, if a local attacker is able to trick a local user into running a Java application (which uses a function to load native libraries, such as System.loadLibrary) from within an attacker-controlled directory containing a malicious library or module, the attacker could possibly execute arbitrary code with the privileges of the user running the Java application. (CVE-2009-3736)

All gcc and gcc4 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running Java applications using libgcj must be restarted for this update to take effect.

Multiple security vulnerabilities has been identified and fixed in xmlsec1 :

A missing check for the recommended minimum length of the truncated form of HMAC-based XML signatures was found in xmlsec1 prior to 1.2.12. An attacker could use this flaw to create a specially crafted XML file that forges an XML signature, allowing the attacker to bypass authentication that is based on the XML Signature specification (CVE-2009-0217).

All versions of libtool prior to 2.2.6b suffers from a local privilege escalation vulnerability that could be exploited under certain conditions to load arbitrary code (CVE-2009-3736).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update fixes this vulnerability.

ID	Name	Product	Family	Published	Updated	Severity
67985	Oracle Linux 5gcc / および / gcc4ELSA-2010-0039	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
217129	Linux Distros のパッチ未適用の脆弱性: CVE-2009-3736	Nessus	Misc.	3/3/2025	9/3/2025	critical
47274	Fedora 11 : gnash-0.8.6-13.fc11 (2010-1833)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
47296	Fedora 11 : mingw32-libltdl-1.5.26-17.fc11 (2010-2943)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
47301	Fedora 12 : esorex-3.7.2-5.fc12 (2010-3216)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
47307	Fedora 11 : esorex-3.7.2-3.fc11 (2010-3314)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
52539	Fedora 14 : q-7.11-8.fc14 (2011-1967)	Nessus	Fedora Local Security Checks	3/4/2011	1/11/2021	medium
60722	Scientific Linux Security Update : gcc and gcc4 on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
67985	Oracle Linux 5 : gcc / and / gcc4 (ELSA-2010-0039)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
217129	Linux Distros Unpatched Vulnerability : CVE-2009-3736	Nessus	Misc.	3/3/2025	9/3/2025	critical
43629	openSUSE Security Update : libltdl-3 (libltdl-3-1638)	Nessus	SuSE Local Security Checks	1/5/2010	1/14/2021	medium
43634	SuSE 10 Security Update : libtool (ZYPP Patch Number 6678)	Nessus	SuSE Local Security Checks	1/5/2010	1/14/2021	medium
43882	RHEL 3 / 4 / 5 : gcc and gcc4 (RHSA-2010:0039)	Nessus	Red Hat Local Security Checks	1/14/2010	1/14/2021	medium
43021	Mandriva Linux Security Advisory : xmlsec1 (MDVSA-2009:318)	Nessus	Mandriva Local Security Checks	12/7/2009	1/6/2021	medium

Detections

Analytics

Plugins Search

critical

critical

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium