#2499 insecure LD_LIBRARY_PATH usage

Security
pending-fixed
sfcb (1090)
5
2014-08-16
2012-07-09
No

CVE-2012-3381

/etc/init.d/sfcb uses:

LD_LIBRARY_PATH=/usr/lib:$LD_LIBRARY_PATH

which is insecure if LD_LIBRARY_PATH is empty. It makes binaries use
libraries from the current directory, which is a problem if e.g. a
administrator
starts the sfcb service from a untrusted directory.

Also it uses it to set /usr/lib, a default path.

Just get rid of the whole if ... as it is useless.

References:
https://access.redhat.com/security/cve/CVE-2012-3381
https://bugzilla.novell.com/show_bug.cgi?id=770234

Discussion

  • Michael Chase-Salerno

    Will fix the issue, but I believe that we do need to keep this code in. It may appear useless in your particular case, where it is /usr/lib, but that pathname is based on the prefix that sfcb is built with. So it could be /usr/local/lib or any pathname.

     
  • Michael Chase-Salerno

    • assigned_to: buccella --> hellerda
     
  • Dave Heller

    Dave Heller - 2012-07-27

    This patch ensures LD_LIBRARY_PATH will never end in a colon. It also fixes a bug where LD_LIBRARY_PATH would not be updated if the current LD_LIBRARY_PATH included a path containing the SFCB libdir but was not the SFCB libdir (e.g. a subdirectory of libdir).

    It occurred to me there is more than one approach to the trailing colon issue:

    1. ensure a colon is never added when we set a new LD_LIBRARY_PATH
    2. additionally remove any trailing colon when we prepend our path to LD_LIBRARY_PATH
    3. always remove the trailing colon even in the cases where we do not alter LD_LIBRARY_PATH (i.e. already includes our path)

    Normally I would go with the least intrusive change (option 1) but in this case, since it is a potential security issue, and since we are only setting SFCB environment, we may want option 3. Option 2 does not seem good; if we are going to alter the existing LD_LIBRARY_PATH we should be consistent about it.

    The only way I can think of where this would break something is: if a provider depends on some custom LD_LIBRARY_PATH to be set before SFCB starts and also requires that LD_LIBRARY_PATH to end in colon.

    The attached patch implements option 3. If there is feedback to the contrary I can change it.

     
  • Dave Heller

    Dave Heller - 2012-07-29

    After discussing with SFCB team we have decided on option 1. Committed to CVS head and git master.

     
  • Dave Heller

    Dave Heller - 2012-07-29
    • status: open --> pending-fixed
     

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks