oss-sec mailing list archives
Re: CVE-2009-0876 (VirtualBox) references
From: "Steven M. Christey" <coley () linus mitre org>
Date: Tue, 17 Mar 2009 15:51:09 -0400 (EDT)
On Tue, 17 Mar 2009, Nico Golde wrote:
Any reason the CVE description says "Unspecified vulnerability...via unknown vectors"?
This was based on the original Sun alert. I cleaned up the description yesterday, and the CVE web site was updated today.
Looking at the Gentoo bug report[0] it seems obvious to me that this is caused by insecurely loading shared libraries so you can inject your own shared lib code. [0] https://bugs.gentoo.org/show_bug.cgi?id=260331#c0
It wasn't particularly obvious to me. I may be getting hung up on the use of hardlinks. Is the problem that the executable includes a "." in its library path (presumably DT_RPATH), and that path isn't cleansed until later during program execution? If it's just that, then the use of a hardlink doesn't seem to be essential - the attacker could run the program from their own directory. Or, is it that the executable eventually removes "." from its path, but not before some libraries have already been loaded? - Steve
Current thread:
- CVE-2009-0876 (VirtualBox) references Robert Buchholz (Mar 15)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Steven M. Christey (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Steven M. Christey (Mar 17)
- Re: CVE-2009-0876 (VirtualBox) references Nico Golde (Mar 17)