Bug 24330

Summary: CVE-2010-3364: insecure library loading
Product: Sisyphus Reporter: Vladimir Lettiev <crux>
Component: vipsAssignee: Michael Shigorin <mike>
Status: CLOSED FIXED QA Contact: qa-sisyphus
Severity: blocker    
Priority: P3 CC: mike, rom_as
Version: unstableKeywords: security
Hardware: all   
OS: Linux   
URL: http://bugs.debian.org/598296

Description Vladimir Lettiev 2010-10-16 12:29:13 MSD 
The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.

Vulnerable code follows:

/usr/bin/vips-7.22 line 108:
	export LD_LIBRARY_PATH=$VIPSHOME/lib:$LD_LIBRARY_PATH

When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.
Comment 1 Michael Shigorin 2010-10-16 14:25:58 MSD 
Исправлено в 7.22.3, собираю 7.22.4.
Comment 2 Repository Robot 2010-10-17 23:20:23 MSD 
vips-7.22.4-alt1 -> sisyphus:

* Sat Oct 16 2010 Michael Shigorin <mike@altlinux> 7.22.4-alt1
- 7.22.4
- minor spec cleanup

* Sat Oct 16 2010 Michael Shigorin <mike@altlinux> 7.22.3-alt1
- 7.22.3 fixes CVE-2010-3364 (insecure library loading);
  thanks crux@ for heads-up (closes: #24330)