blob: 479da6e6c063781a29df0cda66296a8ec01779f5 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200509-05">
<title>Net-SNMP: Insecure RPATH</title>
The Gentoo Net-SNMP package may provide Perl modules containing an insecure
DT_RPATH, potentially allowing privilege escalation.
<product type="ebuild">net-snmp</product>
<announced>September 06, 2005</announced>
<revised>May 22, 2006: 02</revised>
<package name="net-analyzer/net-snmp" auto="yes" arch="*">
<unaffected range="ge"></unaffected>
<vulnerable range="lt"></vulnerable>
Net-SNMP is a suite of applications used to implement the Simple
Network Management Protocol.
James Cloos reported that Perl modules from the Net-SNMP package look
for libraries in an untrusted location. This is due to a flaw in the
Gentoo package, and not the Net-SNMP suite.
<impact type="normal">
A local attacker (member of the portage group) may be able to create a
shared object that would be loaded by the Net-SNMP Perl modules,
executing arbitrary code with the privileges of the user invoking the
Perl script.
Limit group portage access to trusted users.
All Net-SNMP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-analyzer/net-snmp-;</code>
<uri link="">CVE-2005-2811</uri>
<metadata tag="requester" timestamp="Sun, 04 Sep 2005 14:57:52 +0000">
<metadata tag="bugReady" timestamp="Sun, 04 Sep 2005 15:49:44 +0000">
<metadata tag="submitter" timestamp="Sun, 04 Sep 2005 23:48:38 +0000">