REDHAT-BUG-838160: Low severity SUSE sfcb vulnerability
SuSE Bugzilla reports:
Marcus Meissner 2012-07-06 12:18:54 UTC
found by grep.
/etc/init.d/sfcb uses:
LDLIBRARYPATH=/usr/lib:$LDLIBRARYPATH
which is insecure if LDLIBRARYPATH is empty. It makes binaries use libraries from the current directory, which is a problem if e.g. a administrator starts the sfcb service from a untrusted directory.
Also it uses it to set /usr/lib, a default path.
Just get rid of the whole if ... as it is useless.
https://bugzilla.novell.com/showbug.cgi?id=770234
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-838160?
The severity of REDHAT-BUG-838160 is high due to the potential security risks of using shared libraries from current directories.
How do I fix REDHAT-BUG-838160?
To fix REDHAT-BUG-838160, ensure that the LD_LIBRARY_PATH is properly configured to avoid including the current directory.
What software is affected by REDHAT-BUG-838160?
The software affected by REDHAT-BUG-838160 is SuSE sfcb.
What are the risks associated with REDHAT-BUG-838160?
The risks associated with REDHAT-BUG-838160 include potential execution of malicious code if untrusted libraries are loaded.
Is the issue in REDHAT-BUG-838160 resolved?
As of the last update, REDHAT-BUG-838160 remains unaddressed, requiring users to mitigate the risk manually.