469882 – (CVE-2008-4815) CVE-2008-4815 Adobe Reader: insecure RPATH flaw

Bug 469882 (CVE-2008-4815) - CVE-2008-4815 Adobe Reader: insecure RPATH flaw

Summary: CVE-2008-4815 Adobe Reader: insecure RPATH flaw

Keywords:
Status:	CLOSED ERRATA
Alias:	CVE-2008-4815
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Red Hat Product Security
QA Contact:
Docs Contact:
URL:	http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On:	469916 469917 469918
Blocks:
TreeView+	depends on / blocked

Reported:	2008-11-04 16:16 UTC by Josh Bressers
Modified:	2019-09-29 12:26 UTC (History)
CC List:	3 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2008-11-13 15:36:49 UTC
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2008:0974	0	normal	SHIPPED_LIVE	Critical: acroread security update	2008-11-12 17:26:33 UTC

Description Josh Bressers 2008-11-04 16:16:49 UTC

Adobe Reader was built to use insecure RPATH in the binary.

This issue could possibly be exploited by a local attacker to run arbitrary
code as some other user if victim user can be convinced to run Adobe Reader
in an attacker controlled directory with specially crafted content.

Comment 2 Tomas Hoger 2008-11-05 08:24:03 UTC

Public now via upstream security bulletin:
  http://www.adobe.com/support/security/bulletins/apsb08-19.html

Comment 4 Red Hat Product Security 2008-11-13 15:36:49 UTC

This issue was addressed in:

Red Hat Enterprise Linux Extras:
  http://rhn.redhat.com/errata/RHSA-2008-0974.html

Note You need to log in before you can comment on or make changes to this bug.