Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0415 to the following vulnerability: Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD_PRELOAD path. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0415 http://www.openwall.com/lists/oss-security/2009/01/29/5 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456 http://www.securityfocus.com/bid/33516
This issue affects all versions of the trickle package, as shipped with Fedora releases of 9, 10 and devel. Please fix.
As the package provides trickle-overload.so in %libdir/trickle/ , I think I can juste patch trickle.c and change : char *trypaths[] = { LIBNAME, LIBDIR "/" LIBNAME, NULL }; to char *trypaths[] = { LIBDIR "/" LIBNAME, NULL };
seems ok to me ! or perhaps just change priority: char *trypaths[] = { LIBDIR "/" LIBNAME, LIBNAME, NULL };
As no patch seems available atm, I'll remove "LIBNAME" from "trypath"
Don't know why bodhi did not update this bug. The update is available for F9 and F10 in updates-testing repository
Looking at the change that was used: http://cvs.fedoraproject.org/viewvc/rpms/trickle/devel/trickle.spec?r1=1.3&r2=1.4 This fix looks quite fragile to me, as any future change to the trickle.c (e.g. future version update) can easily cause the offending line to change it's position in the file and result it deletion some other line (that may or may not be caught during the compile). Regex-controlled deletion may be slightly better, standalone diff still sounds like the safest alternative.
That's true. I pushed a new release with a patch instead of a sed.
trickle-1.07-7.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
trickle-1.07-7.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
It seems that koji does not close this bug, so I do it myself.