CVE-2011-1095: Medium severity gnu c library vulnerability
Harald van Dijk discovered [1],[2] that glibc's locale command does not sufficiently sanitize the user environment. According to POSIX specifications [3], the output of the 'locale' command must be appropriately quoted and safe to execute, in order to restore the locale after temporarily forcing a change (such as LCALL=C). However, this is not the case with glibc versions up to and including 2.12.1:
LANG=' rm -rf /' locale locale: Cannot set LCCTYPE to default locale: No such file or directory locale: Cannot set LCMESSAGES to default locale: No such file or directory locale: Cannot set LCALL to default locale: No such file or directory LANG= rm -rf / LCCTYPE=" rm -rf /" LCNUMERIC=" rm -rf /" LCTIME=" rm -rf /" LCCOLLATE=" rm -rf /" LCMONETARY=" rm -rf /" LCMESSAGES=" rm -rf /" LCPAPER=" rm -rf /" LCNAME=" rm -rf /" LCADDRESS=" rm -rf /" LCTELEPHONE=" rm -rf /" LCMEASUREMENT=" rm -rf /" LCIDENTIFICATION=" rm -rf /" LCALL=
Any script that does "eval $(locale)" or something similar will execute the unquoted commands.
The POSIX specification states:
"The <value> and <implied value> shown above shall be properly quoted for possible later reentry to the shell. The <value> shall not be quoted using double-quotes (so that it can be distinguished by the user from the <implied value> case, which always requires double-quotes)."
This has been corrected upstream [4].
[1] http://bugs.gentoo.org/showbug.cgi?id=330923 [2] http://sources.redhat.com/bugzilla/showbug.cgi?id=11904 [3] http://www.opengroup.org/onlinepubs/000095399/utilities/locale.html [4] http://sourceware.org/git/?p=glibc.git;a=patch;h=026373745eab50a683536d950cb7e17dc98c4259
Other sources
locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1095?
CVE-2011-1095 is classified as a high severity vulnerability due to its potential for exploitation via arbitrary command execution.
How do I fix CVE-2011-1095?
To mitigate CVE-2011-1095, update the GNU C Library (glibc) to the latest version that addresses this vulnerability.
Which versions of glibc are affected by CVE-2011-1095?
CVE-2011-1095 affects various versions of glibc, including but not limited to 2.0 through 2.12.2.
What are the potential impacts of CVE-2011-1095?
Exploiting CVE-2011-1095 may allow an attacker to execute arbitrary commands, which could lead to system compromise.
Is there a workaround for CVE-2011-1095 if I cannot immediately update?
As a temporary workaround for CVE-2011-1095, consider restricting user permissions or disabling the locale command in untrusted environments.