Bug 358785

Summary:	<sys-cluster/resource-agents-1.0.4-r1: Insecure LD_LIBRARY_PATH handling
Product:	Gentoo Security	Reporter:	Tim Sammut (RETIRED) <underling>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	cluster
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://hg.linux-ha.org/agents/rev/c9373b3d7d8e
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---

Description Tim Sammut (RETIRED) gentoo-dev

2011-03-14 04:06:12 UTC

From the Secunia advisory at: http://secunia.com/advisories/43375/

Two security issues have been reported in resource-agents, which can
be exploited by malicious, local users to gain escalated privileges.

The security issues are caused due to the "SAPDatabase" and
"SAPInstance" scripts incorrectly setting the environment variable
LD_LIBRARY_PATH. This can be exploited to gain escalated privileges
by e.g. tricking a user into running the script in a directory
containing a malicious library.


@cluster, is =sys-cluster/resource-agents-1.0.4-r1 a suitable target for stabilization? I believe 1.0.4 contains this fix. Thanks.

Comment 1 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev

2011-03-14 07:06:34 UTC

Please proceed with stabilization of =sys-cluster/resource-agents-1.0.4-r1

Comment 2 Tim Sammut (RETIRED) gentoo-dev

2011-03-14 12:39:34 UTC

(In reply to comment #1)
> Please proceed with stabilization of =sys-cluster/resource-agents-1.0.4-r1

Great, thank you.

Arches, please test and mark stable:
=sys-cluster/resource-agents-1.0.4-r1
Target keywords : "amd64 hppa x86"

Comment 3 Agostino Sarubbo gentoo-dev

2011-03-14 14:48:36 UTC

posted bug 358883

Comment 4 Agostino Sarubbo gentoo-dev

2011-03-14 15:04:31 UTC

amd64 ok

Comment 5 Markos Chandras (RETIRED) gentoo-dev

2011-03-14 20:47:40 UTC

amd64 done. Thanks Agostino

Comment 6 Jeroen Roovers (RETIRED) gentoo-dev

2011-03-15 16:00:27 UTC

Stable for HPPA.

Comment 7 Thomas Kahle (RETIRED) gentoo-dev

2011-03-17 22:39:12 UTC

x86 stable. Closing. Thanks.

Comment 8 Thomas Kahle (RETIRED) gentoo-dev

2011-03-17 22:39:46 UTC

sorry...

Comment 9 Tim Sammut (RETIRED) gentoo-dev

2011-03-19 22:37:32 UTC

Thanks, folks. GLSA Vote: yes.

Comment 10 Stefan Behte (RETIRED) gentoo-dev

2011-10-08 22:45:04 UTC

Vote: YES. New GLSA request filed.

Comment 11 GLSAMaker/CVETool Bot gentoo-dev

2014-12-12 00:37:11 UTC

This issue was resolved and addressed in
 GLSA 201412-09 at http://security.gentoo.org/glsa/glsa-201412-09.xml
by GLSA coordinator Sean Amoss (ackle).