PT-2010-4773 · Cern · Root

Raphael Geissert · Published 2010-10-20 · Updated 2010-10-21 · CVE-2010-3376

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ROOT versions 5.18/00

Description The issue concerns the proofserv, xrdcp, xrdpwdadmin, and xrd scripts in ROOT, which place a zero-length directory name in the LD LIBRARY PATH. This allows local users to gain privileges via a Trojan horse shared library in the current working directory.

Recommendations For ROOT version 5.18/00, consider restricting access to the LD LIBRARY PATH environment variable to prevent unauthorized modifications, and avoid using the proofserv, xrdcp, xrdpwdadmin, and xrd scripts until a patch is available. As a temporary workaround, consider setting the LD LIBRARY PATH to a known safe value before executing these scripts.

Exploit

Fix

Related Identifiers

CVE-2010-3376

Affected Products

Root

References · 3

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598420 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598419 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3376 · Security Note