<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">Subject: </th>
<td>[LAD] interesting security update to bristol just came out</td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">Date: </th>
<td>Mon, 15 Nov 2010 09:39:08 -0800</td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">From: </th>
<td>Niels Mayer <a class="moz-txt-link-rfc2396E" href="mailto:nielsmayer@gmail.com"><nielsmayer@gmail.com></a></td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">To: </th>
<td>Linux Audio Developers
<a class="moz-txt-link-rfc2396E" href="mailto:linux-audio-dev@lists.linuxaudio.org"><linux-audio-dev@lists.linuxaudio.org></a>, PlanetCCRMA mailinglist
<a class="moz-txt-link-rfc2396E" href="mailto:planetccrma@ccrma.stanford.edu"><planetccrma@ccrma.stanford.edu></a>, fedora-music-list
<a class="moz-txt-link-rfc2396E" href="mailto:fedora-music-list@redhat.com"><fedora-music-list@redhat.com></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>I noticed that bristol-0.40.7-7 updated due to the following security
update. What got me curious is what kind of security issue could
running bristol possibly pose?? -- none on it's own, but another rogue
package could exploit this issue ...
<a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=638376">https://bugzilla.redhat.com/show_bug.cgi?id=638376</a>
.................
Raphael Geissert conducted a review of various packages in Debian and found
that bristol contained a script that could be abused by an attacker to execute
arbitrary code [1].
The vulnerability is due to an insecure change to LD_LIBRARY_PATH, and
environment variable used by ld.so(8) to look for libraries in directories
other than the standard paths. When there is an empty item in the
colon-separated list of directories in LD_LIBRARY_PATH, ld.so(8) treats it as a
'.' (current working directory). If the given script is executed from a
directory where a local attacker could write files, there is a chance for
exploitation.
In Fedora, /usr/bin/startBristol re-sets LD_LIBRARY_PATH insecurely:
declare -x
LD_LIBRARY_PATH=/usr/lib:/usr/local/lib:${LD_LIBRARY_PATH}:${BRISTOL}/lib
A solution is to patch the script to test if $LD_LIBRARY_PATH is set first
before attempting to modify it:
if [ -z ${LD_LIBRARY_PATH} ]; then
export LD_LIBRARY_PATH=/usr/lib/foo
else
export LD_LIBRARY_PATH=/usr/lib/foo:${LD_LIBRARY_PATH}
fi
This issue has been assigned the name CVE-2010-3351.
[1] <a class="moz-txt-link-freetext" href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598285">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598285</a>
...........................
Niels
<a class="moz-txt-link-freetext" href="http://nielsmayer.com">http://nielsmayer.com</a>
_______________________________________________
Linux-audio-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Linux-audio-dev@lists.linuxaudio.org">Linux-audio-dev@lists.linuxaudio.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxaudio.org/listinfo/linux-audio-dev">http://lists.linuxaudio.org/listinfo/linux-audio-dev</a>
</pre>
</body>
</html>