CVE-2008-1951: Medium severity red hat enterprise linux vulnerability
It was discovered that libraries shipped in sblim packages in Red Hat Enterprise Linux 4 and 5 have RPATH set pointing to a directory in a world-writable temporary directory: /var/tmp/sblim-<version>-<release>-root-brewbuilder//usr/lib . That directory existed on the build system during the package build, but is unlikely to exist on systems where sblim packages are installed.
This issue can be exploited by a local user to create fake library required by sblim libraries and execute arbitrary code with the privileges of the application using sblim such as tog-pegasus.
Other sources
Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el46.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el52.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1951?
CVE-2008-1951 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive resources.
How do I fix CVE-2008-1951?
To fix CVE-2008-1951, update the sblim packages in Red Hat Enterprise Linux 4 and 5 to the latest patched versions.
What systems are affected by CVE-2008-1951?
CVE-2008-1951 affects Red Hat Enterprise Linux versions 4 and 5 that include the vulnerable sblim packages.
What is the nature of the vulnerability in CVE-2008-1951?
The vulnerability in CVE-2008-1951 arises from the RPATH being set to a world-writable temporary directory, which could be exploited by attackers.
Is there a workaround for CVE-2008-1951?
A potential workaround for CVE-2008-1951 involves changing the permissions of the RPATH directory to remove world-writable access.