CVE-2010-4000: Medium severity Gnome gnome-shell vulnerability
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Other sources
Ludwig Nussel discovered that gnome-shell contained a script that could be abused by an attacker to execute arbitrary code.
The vulnerability is due to an insecure change to LDLIBRARYPATH, and environment variable used by ld.so(8) to look for libraries in directories other than the standard paths. When there is an empty item in the colon-separated list of directories in LDLIBRARYPATH, ld.so(8) treats it as a '.' (current working directory). If the given script is executed from a directory where a local attacker could write files, there is a chance for exploitation.
In Fedora, /usr/bin/gnome-shell re-sets LDLIBRARYPATH insecurely:
163 if os.path.exists(mozjslibdir + '/libmozjs.so'): 164 env['LDLIBRARYPATH'] = os.environ.get('LDLIBRARYPATH', '') + ':' + mozjslibdir ... 206 return subprocess.Popen(args, env=env)
A solution is to patch the script to test if LDLIBRARYPATH is previously set:
if os.environ.get('LDLIBRARYPATH'): env['LDLIBRARYPATH'] = os.environ.get('LDLIBRARYPATH', '') + ':' + mozjslibdir else: env['LDLIBRARYPATH'] = mozjslibdir
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4000?
CVE-2010-4000 has a medium severity, allowing local users to potentially gain elevated privileges.
How can I fix CVE-2010-4000?
To fix CVE-2010-4000, upgrade to a version of GNOME Shell that does not include this vulnerability.
Who discovered the issue described in CVE-2010-4000?
The issue in CVE-2010-4000 was discovered by Ludwig Nussel.
What software is affected by CVE-2010-4000?
CVE-2010-4000 specifically affects GNOME Shell version 2.31.5.
What type of attack does CVE-2010-4000 enable?
CVE-2010-4000 enables local users to execute a Trojan horse shared library in the current working directory.