After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 485224 - [PATCH] Insecure LD_LIBRARY_PATH Privilege Escalation
[PATCH] Insecure LD_LIBRARY_PATH Privilege Escalation
Status: RESOLVED FIXED
Product: tomboy
Classification: Applications
Component: General
unspecified
Other All
: Normal major
: ---
Assigned To: Tomboy Maintainers
Tomboy Maintainers
Depends on:
Blocks:
 
 
Reported: 2007-10-09 23:07 UTC by Robert Buchholz
Modified: 2008-02-26 20:46 UTC
See Also:
GNOME target: ---
GNOME version: 2.19/2.20

Attachments
tomboy-trunk-insecure-ldpath.patch (1.41 KB, patch)
2007-10-15 23:33 UTC, Robert Buchholz 		committed Details | Review

Description Robert Buchholz 2007-10-09 23:07:05 UTC 
Please describe the problem:
Quoting from [1]:

/usr/bin/tomboy from app-misc/tomboy contains line:

    export LD_LIBRARY_PATH="/usr/lib64/tomboy:$LD_LIBRARY_PATH"

which yields to LD_LIBRARY_PATH="/usr/lib64/tomboy:", what means that required
libraries are also looked up in current directory. In the case of tomboy, it is
usually user's home directory, but user may run application from directories
like /tmp as well. If someone is able to copy bogus system libraries to this
directory, user could potentially run enemy code.



Please refer to [1] and [2] for details.

[1] https://bugs.gentoo.org/188806
[2] http://secunia.com/advisories/26480/

Steps to reproduce:


Actual results:


Expected results:


Does this happen every time?


Other information:
Comment 1 Robert Buchholz 2007-10-15 23:33:22 UTC 
Created attachment 97264 [details] [review]
tomboy-trunk-insecure-ldpath.patch

Should fix this issue.
Comment 2 Alex Graveley 2007-10-16 00:06:09 UTC 
Looks fine to me.  I guess requiring bash isn't a big deal?
Comment 3 Robert Buchholz 2007-10-16 15:48:32 UTC 
I researched again, this kind of expansion is POSIX and not bash specific as I first thought. A quick test also confirmed this.
Comment 4 Robert Buchholz 2007-11-04 00:27:54 UTC 
ping
Comment 5 Boyd Timothy 2007-11-09 17:11:11 UTC 
Applied to SVN Trunk (r1629) and to gnome-2-20 branch (r1630).  Thanks for the report and patch!