Bug 342327 – sys-libc/glibc: arbitrary code execution (CVE-2010-3856)

• Product: Gentoo Security
• Status: RESOLVED DUPLICATE

[Description Andrey Batyiev 2010-10-23 15:12:06 UTC]

http://seclists.org/fulldisclosure/2010/Oct/344

Works on Gentoo with sys-libs/glibc-2.11.2

Reproducible: Always

Steps to Reproduce:

[Comment 1 SpanKY 2010-10-23 20:58:23 UTC]

*** This bug has been marked as a duplicate of bug 341755 ***

[Comment 2 Stefan Behte (RETIRED) 2010-10-24 12:37:27 UTC]

Andrey: Thanks for the report, but please use the search function before filing bugs in the future.

[Comment 3 Andrey Batyiev 2010-10-24 22:24:33 UTC]

(In reply to comment #2)
> Andrey: Thanks for the report, but please use the search function before filing
> bugs in the future.
> 

I think it's different bugs, second found by author of first one during more analysis.

[Comment 4 George Kadianakis (RETIRED) 2010-10-24 22:33:04 UTC]

> (In reply to comment #2)
> > Andrey: Thanks for the report, but please use the search function before filing
> > bugs in the future.
> > 
> 
> I think it's different bugs, second found by author of first one during more
> analysis.
> 

Yep, Andrey, they are different bugs but they got assigned the same entry in the bugzilla.
Check out bug #341755, that SpanKY linked to.

Thanks for the report.

[Comment 5 Andrey Batyiev 2010-10-24 22:43:05 UTC]

(In reply to comment #4)
> Yep, Andrey, they are different bugs but they got assigned the same entry in
> the bugzilla.
> Check out bug #341755, that SpanKY linked to.
> 
> Thanks for the report.
> 

They got assigned same entry *after* i filled this one. That one was "[Bug 341755] sys-libs/glibc library dynamic linker expands $ORIGIN in setuid library search path (CVE-2010-3847)". This bug has nothing with $ORIGIN expansion.