CVE-2008-1951
sblim: libraries built with insecure RPATH
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
Vulnerabilidad de búsqueda de ruta no confiable en ciertas secuencias de comandos web usadas para "construir" Standards Based Linux Instrumentation for Manageability (sblim) bibliotecas anteriores a 1-13a.el4_6.1 en Red Hat Enterprise Linux (RHEL) 4 y anteriores a 1-31.el5_2.1 en RHEL 5. Permite a usuarios locales elevar sus privilegios a través de una biblioteca maliciosa en cierto directorio de var/tmp, relacionado con una incorrecta configuración RPATH, como se muestra en una librería maliciosa libc.so para tog-pegasus.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2008-04-24 CVE Reserved
- 2008-06-25 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-426: Untrusted Search Path
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/29913 | Third Party Advisory | |
| http://www.securitytracker.com/id?1020354 | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/43315 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9635 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=447705 | 2008-06-24 | |
| https://rhn.redhat.com/errata/RHSA-2008-0497.html | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2008-1951 | 2008-06-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 4 Search vendor "Redhat" for product "Enterprise Linux" and version "4" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 5 Search vendor "Redhat" for product "Enterprise Linux" and version "5" | - |
Affected
| ||||||