CVE-2012-3381: Medium severity Standards Based Linux Instrumentation sblim-sfcb vulnerability
sfcb in sblim-sfcb places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Other sources
SuSE Bugzilla reports:
Marcus Meissner 2012-07-06 12:18:54 UTC
found by grep.
/etc/init.d/sfcb uses:
LDLIBRARYPATH=/usr/lib:$LDLIBRARYPATH
which is insecure if LDLIBRARYPATH is empty. It makes binaries use libraries from the current directory, which is a problem if e.g. a administrator starts the sfcb service from a untrusted directory.
Also it uses it to set /usr/lib, a default path.
Just get rid of the whole if ... as it is useless.
https://bugzilla.novell.com/showbug.cgi?id=770234
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3381?
CVE-2012-3381 has a medium severity rating of 4.4.
How do I fix CVE-2012-3381?
To fix CVE-2012-3381, ensure that the LD_LIBRARY_PATH variable is not set to a zero-length directory name.
What types of systems are affected by CVE-2012-3381?
CVE-2012-3381 affects systems using the sblim-sfcb software, particularly Standards Based Linux Instrumentation.
Can CVE-2012-3381 be exploited remotely?
No, CVE-2012-3381 can only be exploited by local users who have access to the system.
What are the potential impacts of CVE-2012-3381?
CVE-2012-3381 can allow local users to gain elevated privileges via a Trojan horse shared library.