[go: up one dir, main page]

Debian Bug report logs - #559808
CVE-2009-3736 local privilege escalation

Package: gnash; Maintainer for gnash is (unknown);

Reported by: Michael Gilbert <michael.s.gilbert@gmail.com>

Date: Mon, 7 Dec 2009 04:57:15 UTC

Severity: important

Tags: help, security

Done: Gabriele Giacone <1o5g4r8o@gmail.com>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Miriam Ruiz <little_miry@yahoo.es>:
Bug#559808; Package gnash. (Mon, 07 Dec 2009 04:57:18 GMT) (full text, mbox, link).


Acknowledgement sent to Michael Gilbert <michael.s.gilbert@gmail.com>:
New Bug report received and forwarded. Copy sent to Miriam Ruiz <little_miry@yahoo.es>. (Mon, 07 Dec 2009 04:57:18 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>
To: submit@bugs.debian.org
Subject: CVE-2009-3736 local privilege escalation
Date: Sun, 6 Dec 2009 23:55:11 -0500
Package: gnash
Severity: grave
Tags: security

Hi,

The following CVE (Common Vulnerabilities & Exposures) id was
published for libtool.  I have determined that this package embeds a
vulnerable copy of the libtool source code.  However, since this is a
mass bug filing (due to so many packages embedding libtool), I have not
had time to determine whether the vulnerable code is actually present
in any of the binary packages. Please determine whether this is the
case. If the package is not affected, please feel free to close the bug
with a message containing the details of what you did to check.

CVE-2009-3736[0]:
| ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b,
| attempts to open a .la file in the current working directory, which
| allows local users to gain privileges via a Trojan horse file.

Note that this problem also affects etch and lenny, so if your package
is affected, please coordinate with the security team to release the
DSA for the affected packages.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3736
    http://security-tracker.debian.org/tracker/CVE-2009-3736




Information forwarded to debian-bugs-dist@lists.debian.org, Miriam Ruiz <little_miry@yahoo.es>:
Bug#559808; Package gnash. (Sat, 12 Dec 2009 23:09:50 GMT) (full text, mbox, link).


Acknowledgement sent to Michael Gilbert <michael.s.gilbert@gmail.com>:
Extra info received and forwarded to list. Copy sent to Miriam Ruiz <little_miry@yahoo.es>. (Sat, 12 Dec 2009 23:09:50 GMT) (full text, mbox, link).


Message #10 received at 559808@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>
To: 559798@bugs.debian.org, 559799@bugs.debian.org, 559800@bugs.debian.org, 559801@bugs.debian.org, 559802@bugs.debian.org, 559803@bugs.debian.org, 559804@bugs.debian.org, 559805@bugs.debian.org, 559806@bugs.debian.org, 559807@bugs.debian.org, 559808@bugs.debian.org, 559809@bugs.debian.org, 559810@bugs.debian.org, 559811@bugs.debian.org, 559812@bugs.debian.org, 559813@bugs.debian.org, 559814@bugs.debian.org, 559815@bugs.debian.org, 559816@bugs.debian.org, 559817@bugs.debian.org, 559818@bugs.debian.org, 559819@bugs.debian.org, 559820@bugs.debian.org, 559821@bugs.debian.org, 559822@bugs.debian.org, 559823@bugs.debian.org, 559824@bugs.debian.org, 559825@bugs.debian.org, 559826@bugs.debian.org, 559827@bugs.debian.org, 559828@bugs.debian.org, 559829@bugs.debian.org, 559830@bugs.debian.org, 559831@bugs.debian.org, 559832@bugs.debian.org, 559833@bugs.debian.org, 559834@bugs.debian.org, 559835@bugs.debian.org, 559836@bugs.debian.org, 559837@bugs.debian.org, 559838@bugs.debian.org, 559839@bugs.debian.org, 559840@bugs.debian.org, 559841@bugs.debian.org, 559842@bugs.debian.org, 559843@bugs.debian.org, 559844@bugs.debian.org, 559845@bugs.debian.org
Subject: CVE-2009-3736 update
Date: Sat, 12 Dec 2009 18:07:00 -0500
Hi all,

It has come to my attention that a lot of maintainers are simply adding
a build-depends on libltdl3-dev to try to solve this problem.  This is
not a sufficient solution since your package will still use the
embedded libtool code copy.  You need to add '--without-included-ltdl'
to your configure arguments to do this right.

A verification, but not really a sufficient proof, is that 
'ldd <your binaries>' shows that the system libtool is being used.

On another note, if your package is affected in either stable or
oldstable, it also must be fixed.  The security team has determined
that this issue is not sufficiently severe to warrant DSAs for the
embedding packages, so instead, you should coordinate a proposed-update
with the release team.

Once you have fixed the problem in unstable (or even before that if
you desire), please open new bugs for stable/oldstable to track the
problem there (if your package is affected).

Thank you for working on this issue.

Mike




Information forwarded to debian-bugs-dist@lists.debian.org, Miriam Ruiz <little_miry@yahoo.es>:
Bug#559808; Package gnash. (Wed, 30 Dec 2009 12:33:03 GMT) (full text, mbox, link).


Acknowledgement sent to Moritz Muehlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Miriam Ruiz <little_miry@yahoo.es>. (Wed, 30 Dec 2009 12:33:03 GMT) (full text, mbox, link).


Message #15 received at 559808@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>
To: 559808@bugs.debian.org
Subject: Re: CVE-2009-3736 local privilege escalation
Date: Wed, 30 Dec 2009 13:29:50 +0100
On Sun, Dec 06, 2009 at 11:55:11PM -0500, Michael Gilbert wrote:
> Package: gnash
> Severity: grave
> Tags: security
> 
> Hi,
> 
> The following CVE (Common Vulnerabilities & Exposures) id was
> published for libtool.  I have determined that this package embeds a
> vulnerable copy of the libtool source code.  However, since this is a
> mass bug filing (due to so many packages embedding libtool), I have not
> had time to determine whether the vulnerable code is actually present
> in any of the binary packages. Please determine whether this is the
> case. If the package is not affected, please feel free to close the bug
> with a message containing the details of what you did to check.

Gnash already has a Build-Depennds on the shared copy, but it appears
as if only the hppa build links against the system copy. I suppose
this needs to be configured explicitely by passing "--without-included-ltdl"
to the configure call.

Cheers,
        Moritz




Information forwarded to debian-bugs-dist@lists.debian.org, Miriam Ruiz <little_miry@yahoo.es>:
Bug#559808; Package gnash. (Mon, 25 Jan 2010 10:24:12 GMT) (full text, mbox, link).


Acknowledgement sent to Stefano Zacchiroli <zack@debian.org>:
Extra info received and forwarded to list. Copy sent to Miriam Ruiz <little_miry@yahoo.es>. (Mon, 25 Jan 2010 10:24:12 GMT) (full text, mbox, link).


Message #20 received at 559808@bugs.debian.org (full text, mbox, reply):

From: Stefano Zacchiroli <zack@debian.org>
To: 559808@bugs.debian.org
Cc: Moritz Muehlenhoff <jmm@inutil.org>
Subject: Re: Bug#559808: CVE-2009-3736 local privilege escalation
Date: Mon, 25 Jan 2010 11:21:41 +0100
[Message part 1 (text/plain, inline)]
tags 559808 + help
thanks

On Wed, Dec 30, 2009 at 01:29:50PM +0100, Moritz Muehlenhoff wrote:
> Gnash already has a Build-Depennds on the shared copy, but it appears
> as if only the hppa build links against the system copy. I suppose
> this needs to be configured explicitely by passing "--without-included-ltdl"
> to the configure call.

I've been rebuilding gnash passing explicitly --without-included-ltdl
(patch attached), but that does not seem to be enough to have the main
gnash package linked against system-wide ltdl.  ldd confirms that the
gtk-gnash executable is not linked against ltdl, whereas the other
binary packages of gnash does link against the system-wide library (that
was the case also without the patch).

At first sight configure.ac seems to be doing the right thing in _not_
forcing the convenience library (it does that only if older versions of
libltdl are found in the sources, which is no longer the case).

Bottom line: some more investigation is needed
Maintainer: any comment?

Cheers.

-- 
Stefano Zacchiroli -o- PhD in Computer Science \ PostDoc @ Univ. Paris 7
zack@{upsilon.cc,pps.jussieu.fr,debian.org} -<>- http://upsilon.cc/zack/
Dietro un grande uomo c'è ..|  .  |. Et ne m'en veux pas si je te tutoie
sempre uno zaino ...........| ..: |.... Je dis tu à tous ceux que j'aime
[diff (text/plain, attachment)]

Added tag(s) help. Request was from Stefano Zacchiroli <zack@debian.org> to control@bugs.debian.org. (Mon, 25 Jan 2010 10:24:15 GMT) (full text, mbox, link).


Severity set to 'important' from 'grave' Request was from Moritz Muehlenhoff <jmm@debian.org> to control@bugs.debian.org. (Wed, 28 Apr 2010 22:03:02 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Flash Team <pkg-flash-devel@lists.alioth.debian.org>:
Bug#559808; Package gnash. (Wed, 08 Jun 2011 19:03:06 GMT) (full text, mbox, link).


Acknowledgement sent to Javier Serrano Polo <javier@jasp.net>:
Extra info received and forwarded to list. Copy sent to Debian Flash Team <pkg-flash-devel@lists.alioth.debian.org>. (Wed, 08 Jun 2011 19:03:06 GMT) (full text, mbox, link).


Message #29 received at 559808@bugs.debian.org (full text, mbox, reply):

From: Javier Serrano Polo <javier@jasp.net>
To: 559808@bugs.debian.org
Subject: Re: CVE-2009-3736 local privilege escalation
Date: Wed, 08 Jun 2011 20:44:47 +0200
[Message part 1 (text/plain, inline)]
This is fixed in 0.8.9-1, isn't it?
[smime.p7s (application/pkcs7-signature, attachment)]

Reply sent to Gabriele Giacone <1o5g4r8o@gmail.com>:
You have taken responsibility. (Sun, 19 Jun 2011 00:09:03 GMT) (full text, mbox, link).


Notification sent to Michael Gilbert <michael.s.gilbert@gmail.com>:
Bug acknowledged by developer. (Sun, 19 Jun 2011 00:09:04 GMT) (full text, mbox, link).


Message #34 received at 559808-done@bugs.debian.org (full text, mbox, reply):

From: Gabriele Giacone <1o5g4r8o@gmail.com>
To: Javier Serrano Polo <javier@jasp.net>, 559808-done@bugs.debian.org
Subject: Re: Bug#559808: CVE-2009-3736 local privilege escalation
Date: Sun, 19 Jun 2011 02:07:36 +0200
On Wed, Jun 08, 2011 at 08:44:47PM +0200, Javier Serrano Polo wrote:
> This is fixed in 0.8.9-1, isn't it?

Already in 0.8.8-5 as [1] says. Closing.

[1] http://security-tracker.debian.org/tracker/CVE-2009-3736




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 17 Jul 2011 07:32:11 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Oct 15 09:17:23 2025; Machine Name: berlioz

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.