blob: 21fbed08c2b6768061c7d6d9bca3ca4a7c27c428 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200509-05">
<title>Net-SNMP: Insecure RPATH</title>
<synopsis>
The Gentoo Net-SNMP package may provide Perl modules containing an insecure
DT_RPATH, potentially allowing privilege escalation.
</synopsis>
<product type="ebuild">net-snmp</product>
<announced>2005-09-06</announced>
<revised count="02">2006-05-22</revised>
<bug>103776</bug>
<access>local</access>
<affected>
<package name="net-analyzer/net-snmp" auto="yes" arch="*">
<unaffected range="ge">5.2.1.2-r1</unaffected>
<vulnerable range="lt">5.2.1.2-r1</vulnerable>
</package>
</affected>
<background>
<p>
Net-SNMP is a suite of applications used to implement the Simple
Network Management Protocol.
</p>
</background>
<description>
<p>
James Cloos reported that Perl modules from the Net-SNMP package look
for libraries in an untrusted location. This is due to a flaw in the
Gentoo package, and not the Net-SNMP suite.
</p>
</description>
<impact type="normal">
<p>
A local attacker (member of the portage group) may be able to create a
shared object that would be loaded by the Net-SNMP Perl modules,
executing arbitrary code with the privileges of the user invoking the
Perl script.
</p>
</impact>
<workaround>
<p>
Limit group portage access to trusted users.
</p>
</workaround>
<resolution>
<p>
All Net-SNMP users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/net-snmp-5.2.1.2-r1"</code>
</resolution>
<references>
<uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2811">CVE-2005-2811</uri>
</references>
<metadata tag="requester" timestamp="2005-09-04T14:57:52Z">
DerCorny
</metadata>
<metadata tag="bugReady" timestamp="2005-09-04T15:49:44Z">
DerCorny
</metadata>
<metadata tag="submitter" timestamp="2005-09-04T23:48:38Z">
adir
</metadata>
</glsa>
|
GitWeb
