PT-2005-5453 · Suse+3 · Suse Linux+3

Lubomir Kundrak · Published 2005-12-31 · Updated 2018-10-30 · CVE-2005-4790

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux versions 9.3 and 10.0

Description The issue is caused by multiple untrusted search path vulnerabilities that add the working directory to LD LIBRARY PATH. This might allow local users to execute arbitrary code via certain applications. The affected applications include beagle, tomboy, and blam.

Recommendations For SUSE Linux versions 9.3 and 10.0, consider restricting access to the affected applications beagle, tomboy, and blam until a fix is available. As a temporary workaround, avoid using the LD LIBRARY PATH variable in sensitive operations to minimize the risk of exploitation. Restrict the working directory permissions to prevent unauthorized access.

Fix

Related Identifiers

CVE-2005-4790

Affected Products

Suse Linux

Beagle

Blam

Tomboy

References · 23

• https://usn.ubuntu.com/560-1 · Vendor Advisory
• http://secunia.com/advisories/28672 · Vendor Advisory
• http://secunia.com/advisories/27799 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200801-14.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4790 · Security Note
• http://secunia.com/advisories/28339 · Vendor Advisory
• http://secunia.com/advisories/26480 · Vendor Advisory
• http://secunia.com/advisories/27621 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_22_sr.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00206.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:064 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00913.html · Vendor Advisory
• http://secunia.com/advisories/27608 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200711-12.xml · Vendor Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=188806 · Note