PT-2019-6557 · Gargoyle · Gargoyle

Published 2019-11-12 · Updated 2020-08-18 · CVE-2010-3359

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions gargoyle-free versions prior to 2009-08-25

Description The issue allows a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so, potentially gaining access to the user's account. This occurs when the LD LIBRARY PATH is undefined.

Recommendations For versions prior to 2009-08-25, define the LD LIBRARY PATH to prevent it from pointing to the current directory, or ensure that users are aware of the potential risk when running gargoyle in untrusted directories.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-3359

Affected Products

Gargoyle

References · 4

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3359 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-3359 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3359 · Vendor Advisory