Lucene search

Ubuntu.comUB:CVE-2012-3381

HistoryAug 17, 2012 - 12:00 a.m.

CVE-2012-3381

2012-08-1700:00:00

ubuntu.com

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

sfcb in sblim-sfcb places a zero-length directory name in the
LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan
horse shared library in the current working directory.

Notes

Author	Note
sbeattie	debian/ubuntu not affected because upstream init scripts are not used; debian init script does not contain LD_LIBRARY_PATH usage

References

www.openwall.com/lists/oss-security/2012/07/06/7

www.openwall.com/lists/oss-security/2012/07/06/8

bugzilla.novell.com/show_bug.cgi?id=770234

bugzilla.redhat.com/show_bug.cgi?id=838160

launchpad.net/bugs/cve/CVE-2012-3381

nvd.nist.gov/vuln/detail/CVE-2012-3381

security-tracker.debian.org/tracker/CVE-2012-3381

www.cve.org/CVERecord?id=CVE-2012-3381

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Related for UB:CVE-2012-3381