Bug 580187 (CVE-2010-0826)
Summary: | CVE-2010-0826 nss_db: Information leak due the DB_CONFIG file read from current working directory | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> | ||||||
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
Status: | CLOSED ERRATA | QA Contact: | |||||||
Severity: | medium | Docs Contact: | |||||||
Priority: | medium | ||||||||
Version: | unspecified | CC: | nalin | ||||||
Target Milestone: | --- | Keywords: | Security | ||||||
Target Release: | --- | ||||||||
Hardware: | All | ||||||||
OS: | Linux | ||||||||
URL: | https://bugs.launchpad.net/ubuntu/+source/libnss-db/+bug/531976 | ||||||||
Whiteboard: | |||||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||||
Doc Text: | Story Points: | --- | |||||||
Clone Of: | Environment: | ||||||||
Last Closed: | 2010-06-25 09:53:56 UTC | Type: | --- | ||||||
Regression: | --- | Mount Type: | --- | ||||||
Documentation: | --- | CRM: | |||||||
Verified Versions: | Category: | --- | |||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||
Embargoed: | |||||||||
Bug Depends On: | 580191, 580192, 580539, 580540, 580541, 580542, 580543, 833945 | ||||||||
Bug Blocks: | |||||||||
Attachments: |
|
Description
Jan Lieskovsky
2010-04-07 16:52:05 UTC
Created attachment 405029 [details]
Local extracted copy of "200-set-db-environment.dpatch"
This issue affects the versions of the nss_db package, as shipped with Red Hat Enterprise Linux 3, 4, and 5. This issue affects the versions of the nss_db package, as shipped with Fedora release of 11 and 12. nss_db-2.2-47.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/nss_db-2.2-47.fc12 nss_db-2.2-46.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/nss_db-2.2-46.fc11 nss_db-2.2.3-0.3.pre1.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/nss_db-2.2.3-0.3.pre1.fc13 nss_db-2.2.3-0.3.pre1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. Created attachment 405473 [details] Ubuntu patch Same thing as comment #1, just throw away unneeded dpatch wrapper and only leave the real patch. (In reply to comment #2) > This issue affects the versions of the nss_db package, > as shipped with Red Hat Enterprise Linux 3, 4, and 5. Further investigation of this issue showed that nss_db packages in Red Hat Enterprise Linux 3 and 4 are not affected, as Berkeley DB versions they use do not attempt to use current working directory as a path to database environment. In Red Hat Enterprise Linux 5, current working directory is used as database environment, which causes nss_db to attempt to use certain files (such as DB_CONFIG or __db.*) from current working directory of the program. This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0347 https://rhn.redhat.com/errata/RHSA-2010-0347.html nss_db-2.2-47.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. nss_db-2.2-46.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report. |