Bug 457935 (CVE-2008-3277)

Summary:	CVE-2008-3277 ibutils: insecure relative RPATH
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	Infiniband QE <infiniband-qe>
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dledford, honli, jlieskov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-21 08:20:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	768400
Bug Blocks:	742493

Description Tomas Hoger 2008-08-05 16:08:59 UTC

ibutils packages as shipped in Red Hat Enterprise Linux 4 and 5 are built to use insecure RPATH set in the ELF header of the ibmssh command.

This issue can possibly be exploited by a local attacker to run arbitrary code as some other user if victim user can be convinced to run ibmssh command in an attacker controlled directory with specially crafted content.

Affected binary: /usr/bin/ibmssh
RPATH: refix/lib

Comment 1 Tomas Hoger 2008-08-05 16:11:51 UTC

Problem seems to be caused by pretty obvious issue in ibmgtsim/src/Makefile.* - $prefix is used instead of $(prefix).

Comment 3 Doug Ledford 2011-08-09 17:02:26 UTC

ibutils-1.5.7-2.el6 fixes this issue in rhel6 at least.

Comment 10 errata-xmlrpc 2012-02-21 03:24:08 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0311 https://rhn.redhat.com/errata/RHSA-2012-0311.html