Bug 645481 (CVE-2010-3376)

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3376 to
the following vulnerability:

The (1) proofserv, (2) xrdcp, (3) xrdpwdadmin, and (4) xrd scripts in
ROOT 5.18/00 place a zero-length directory name in the
LD_LIBRARY_PATH, which allows local users to gain privileges via a
Trojan horse shared library in the current working directory.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3376
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598419
[3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598420


Affected versions:
=================
This issue affects the versions of the root package, as shipped with
Fedora of release 12 and 13. Relevant scripts are in:

  BUILD/root-5.26.00d/config

One sample occurrence of insecure LD_LIBRARY_PATH re-set is in:

  BUILD/root-5.26.00d/config/xrootd.in:

    44         export LD_LIBRARY_PATH=$XRDLIBS:$LD_LIBRARY_PATH

  The above used re-setting of LD_LIBRARY_PATH variable is insecure.

Tomas Hoger suggests (https://bugzilla.redhat.com/show_bug.cgi?id=638384#c2)
the following one-liner as a solution:

  export LD_LIBRARY_PATH=/usr/lib/foo${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}

You can also query Red Hat Bugzilla system for "insecure library loading
vulnerability" string, to get further information about all affected packages
and particular patches.

Also, prior scheduling particular "root" package Fedora v12 and v13 updates,
please check the whole content of the src.rpm package for similar deficiencies
via:

  grep -A2 -B2 -rHn "LD_LIBRARY_PATH" * | more

and fix (with above one-liner all of the insecure occurrences).