gnome-subtitles: CVE-2010-3357: insecure library loading

Debian Bug report logs - #598289
gnome-subtitles: CVE-2010-3357: insecure library loading

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: submit@bugs.debian.org

Subject: gnome-subtitles: CVE-2010-3357: insecure library loading

Date: Tue, 28 Sep 2010 04:21:38 +0000

Package: gnome-subtitles
Version: 1.0-1
Severity: grave
Tags: security
User: team@security.debian.org
Usertags: ldpath

Hello,

During a review of the Debian archive, I've found your package to
contain a script that can be abused by an attacker to execute arbitrary
code.

The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.

Vulnerable code follows:

/usr/bin/gnome-subtitles line 9:
export LD_LIBRARY_PATH="$libdir/gnome-subtitles:$LD_LIBRARY_PATH"

When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.

This vulnerability has been assigned the CVE id CVE-2010-3357. Please make sure
you mention it when forwarding this report to upstream and when fixing
this bug (everywhere: upstream and here at Debian.)

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3357
[1] http://security-tracker.debian.org/tracker/CVE-2010-3357

Sincerely,
Raphael Geissert

Message #10 received at 598289@bugs.debian.org (full text, mbox, reply):

From: d+deb@vdr.jp

To: control@bugs.debian.org

Cc: 598289@bugs.debian.org

Subject: attached upstream fix patch

Date: Sat, 9 Oct 2010 16:13:02 +0900

[Message part 1 (text/plain, inline)]

tags 598289 + patch
thanks

Fixed RedHat bug 638384 - (CVE-2010-3357) CVE-2010-3357 gnome-subtitles: insecure library loading vulnerability

http://git.gnome.org/browse/gnome-subtitles/commit/?id=44370dc2a87f7fa0d6c9730979514bd407a37c65
-- 
Regards,
	dai

GPG Fingerprint = 0B29 D88E 42E6 B765 B8D8 EA50 7839 619D D439 668E

[44370dc2a87f7fa0d6c9730979514bd407a37c65.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 598289-close@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@ubuntu.com>

To: 598289-close@bugs.debian.org

Subject: Bug#598289: fixed in gnome-subtitles 1.0-2

Date: Sun, 17 Oct 2010 12:47:13 +0000

Source: gnome-subtitles
Source-Version: 1.0-2

We believe that the bug you reported is fixed in the latest version of
gnome-subtitles, which is due to be installed in the Debian FTP archive:

gnome-subtitles_1.0-2.diff.gz
  to main/g/gnome-subtitles/gnome-subtitles_1.0-2.diff.gz
gnome-subtitles_1.0-2.dsc
  to main/g/gnome-subtitles/gnome-subtitles_1.0-2.dsc
gnome-subtitles_1.0-2_amd64.deb
  to main/g/gnome-subtitles/gnome-subtitles_1.0-2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 598289@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Iain Lane <laney@ubuntu.com> (supplier of updated gnome-subtitles package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 13 Oct 2010 21:26:29 +0100
Source: gnome-subtitles
Binary: gnome-subtitles
Architecture: source amd64
Version: 1.0-2
Distribution: unstable
Urgency: low
Maintainer: Debian CLI Applications Team <pkg-cli-apps-team@lists.alioth.debian.org>
Changed-By: Iain Lane <laney@ubuntu.com>
Description: 
 gnome-subtitles - Subtitles editor for the GNOME Desktop environment
Closes: 586986 598289
Changes: 
 gnome-subtitles (1.0-2) unstable; urgency=low
 .
   * debian/control:
     + Add depends on gstreamer0.10-plugins-base; app fails to start when this
       is not present (Closes: #586986)
     + Add recommends on gstreamer0.10-ffmpeg — cannot import or preview videos
       without any codecs present
     + Add quilt patchsys
   * debian/patches/insecure_library_loading:
     + Add patch taken from upstream git to fix insecure library loading bug. (Closes: #598289)
       References: CVE-2010-3357
       Thanks to dai for forwarding the patch, and for Pedro Castro for developing it.
Checksums-Sha1: 
 ba4c476634bdbc8e66864a4387331d16ee36936e 2017 gnome-subtitles_1.0-2.dsc
 db6ecdcffc1fa7acdba32dc1ef3a605d110dbf0c 12943 gnome-subtitles_1.0-2.diff.gz
 b37c18d2f92e7033d03904e537e0d5f47983eeab 347930 gnome-subtitles_1.0-2_amd64.deb
Checksums-Sha256: 
 caf629e811a053e7d79d452cd224fb16d790cbe0eacd8ced17210f6cbc57f339 2017 gnome-subtitles_1.0-2.dsc
 4151ff0fc7b467af17b5790777d48280a5c939cfabc3b0facacb185ffeaba3d9 12943 gnome-subtitles_1.0-2.diff.gz
 b538e56df00e3627392e838ec021e9c6be19cb712f19c9b673c165225b214d9d 347930 gnome-subtitles_1.0-2_amd64.deb
Files: 
 1eeaa18a21537388fd219a0b238dd3fe 2017 gnome extra gnome-subtitles_1.0-2.dsc
 9acfa6fa181196273091772ed85985e5 12943 gnome extra gnome-subtitles_1.0-2.diff.gz
 d39eebd30a47a87c93b4d6e8a61363ce 347930 gnome extra gnome-subtitles_1.0-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBCAAGBQJMuu5ZAAoJEMkPnLkOH60MbkUH/0zRxebC5uqAL1q4AgJulXFy
M/7dFixbODM7x41ZIMuXgr9zmIPRhfG1+0SceWbVqEgu7sb3ePxdjunbxJ9cMVy9
xAp+XOG3DgnphvPX03/8chrSvDh0D7nRs1FqBQsMlnfB1IqLsP3e5s1hEpxn0Fmx
5xicpKaihet1HNJBeSmY/MF74p527Bmk0sFG2Lmij3cdUCct355FTz261oLXDAGA
LVJ0moG9eoXJt983wEdDRLJ9fpWDW+glk0oC2c82MHAjOQXZGnW0+8/Lccw7/FXo
vymuy0J1ZMHiadteQyeaibkfSumEoHJGDOroM2b4hmfyKNtP1QPq3e9jA8kHIvo=
=QpIt
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.