CVE-2010-3689: Path Traversal

Dmitri Gribenko discovered that the soffice script in the Openoffice.org package contained an insecure setting for the LDLIBRARYPATH, which could be abused by an attacker to execute arbitrary code.

The vulnerability is due to an insecure change to LDLIBRARYPATH, and environment variable used by ld.so(8) to look for libraries in directories other than the standard paths. When there is an empty item in the colon-separated list of directories in LDLIBRARYPATH, ld.so(8) treats it as a '.' (current working directory). If the given script is executed from a directory where a local attacker could write files, there is a chance for exploitation.

Currently in our soffice script we do...

LDLIBRARYPATH=$mypath${LDLIBRARYPATH+:$LDLIBRARYPATH}

while we should do...

LDLIBRARYPATH=$mypath${LDLIBRARYPATH:+:$LDLIBRARYPATH}

so if someone currently does export LDLIBRARYPATH= then our LDLIBRARYPATH ends up as LDLIBRARYPATH=/path: which has an empty entry which effectively means LDLIBRARYPATH=/path:.

Acknowledgements:

Red Hat would like to thank Dmitri Gribenko for reporting this issue.