Scientific Linux: Critical sblim Security Advisory for SL4.x and SL5.x

Date: Wed, 25 Jun 2008 16:46:44 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA for sblim on SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Important: sblim security update
Issue date:	2008-06-24
CVE Names:	CVE-2008-1951

It was discovered that certain sblim libraries had an RPATH (runtime
library search path) set in the ELF (Executable and Linking Format) header.
This RPATH pointed to a sub-directory of a world-writable, temporary
directory. A local user could create a file with the same name as a library
required by sblim (such as libc.so) and place it in the directory defined
in the RPATH. This file could then execute arbitrary code with the
privileges of the user running an application that used sblim (eg
tog-pegasus). (CVE-2008-1951)

SL 4.x

 SRPMS:
sblim-1-13a.el4_6.1.src.rpm
 i386:
sblim-cmpi-base-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-base-devel-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-base-test-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-devel-1.0.4-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-test-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-network-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-network-devel-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-network-test-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv3-1.0.13-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv3-test-1.0.13-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv4-1.0.11-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv4-test-1.0.11-13a.el4_6.1.i386.rpm
sblim-cmpi-params-1.2.4-13a.el4_6.1.i386.rpm
sblim-cmpi-params-test-1.2.4-13a.el4_6.1.i386.rpm
sblim-cmpi-sysfs-1.1.8-13a.el4_6.1.i386.rpm
sblim-cmpi-sysfs-test-1.1.8-13a.el4_6.1.i386.rpm
sblim-cmpi-syslog-0.7.9-13a.el4_6.1.i386.rpm
sblim-cmpi-syslog-test-0.7.9-13a.el4_6.1.i386.rpm
sblim-gather-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-devel-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-provider-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-test-2.1.1-13a.el4_6.1.i386.rpm
sblim-testsuite-1.2.4-13a.el4_6.1.i386.rpm
sblim-wbemcli-1.5.1-13a.el4_6.1.i386.rpm
 x86_64:
sblim-cmpi-base-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-base-devel-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-base-test-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-devel-1.0.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-devel-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-test-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-devel-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-test-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv3-1.0.13-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv3-test-1.0.13-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv4-1.0.11-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv4-test-1.0.11-13a.el4_6.1.x86_64.rpm
sblim-cmpi-params-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-params-test-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-sysfs-1.1.8-13a.el4_6.1.x86_64.rpm
sblim-cmpi-sysfs-test-1.1.8-13a.el4_6.1.x86_64.rpm
sblim-cmpi-syslog-0.7.9-13a.el4_6.1.x86_64.rpm
sblim-cmpi-syslog-test-0.7.9-13a.el4_6.1.x86_64.rpm
sblim-gather-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-devel-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-provider-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-test-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-testsuite-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-wbemcli-1.5.1-13a.el4_6.1.x86_64.rpm

SL 5.x

 SRPMS:
sblim-1-31.el5_2.1.src.rpm
 i386:
sblim-cim-client-1.3.3-31.el5_2.1.i386.rpm
sblim-cim-client-javadoc-1-31.el5_2.1.i386.rpm
sblim-cim-client-manual-1-31.el5_2.1.i386.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-test-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.i386.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-dns-test-1-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-test-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-test-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv3-1.0.14-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv3-test-1.0.14-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv4-1.0.12-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv4-test-1.0.12-31.el5_2.1.i386.rpm
sblim-cmpi-params-1.2.6-31.el5_2.1.i386.rpm
sblim-cmpi-params-test-1.2.6-31.el5_2.1.i386.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-samba-test-1-31.el5_2.1.i386.rpm
sblim-cmpi-sysfs-1.1.9-31.el5_2.1.i386.rpm
sblim-cmpi-sysfs-test-1.1.9-31.el5_2.1.i386.rpm
sblim-cmpi-syslog-0.7.11-31.el5_2.1.i386.rpm
sblim-cmpi-syslog-test-0.7.11-31.el5_2.1.i386.rpm
sblim-gather-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-test-2.1.2-31.el5_2.1.i386.rpm
sblim-testsuite-1.2.4-31.el5_2.1.i386.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.i386.rpm
sblim-wbemcli-1.5.1-31.el5_2.1.i386.rpm
 x86_64:
sblim-cim-client-1.3.3-31.el5_2.1.x86_64.rpm
sblim-cim-client-javadoc-1-31.el5_2.1.x86_64.rpm
sblim-cim-client-manual-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-test-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.i386.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-test-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-test-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-test-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv3-1.0.14-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv3-test-1.0.14-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv4-1.0.12-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv4-test-1.0.12-31.el5_2.1.x86_64.rpm
sblim-cmpi-params-1.2.6-31.el5_2.1.x86_64.rpm
sblim-cmpi-params-test-1.2.6-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-test-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-sysfs-1.1.9-31.el5_2.1.x86_64.rpm
sblim-cmpi-sysfs-test-1.1.9-31.el5_2.1.x86_64.rpm
sblim-cmpi-syslog-0.7.11-31.el5_2.1.x86_64.rpm
sblim-cmpi-syslog-test-0.7.11-31.el5_2.1.x86_64.rpm
sblim-gather-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-test-2.1.2-31.el5_2.1.x86_64.rpm
sblim-testsuite-1.2.4-31.el5_2.1.x86_64.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.x86_64.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.x86_64.rpm
sblim-wbemcli-1.5.1-31.el5_2.1.x86_64.rpm

-Connie Sieh
-Troy Dawson